Estimated reading time: 5 minutes
AI models are finding software flaws at a record pace, Cisco Talos says. Additions to the list of known exploited vulnerabilities grew far more slowly. Talos expects the surge to level off once AI works through old code.
Published software vulnerabilities rose 105% from a year earlier, Cisco Talos researchers wrote on Oct. 20. Additions to the Known Exploited Vulnerabilities (KEV) catalog rose 37% over the same period. The Cybersecurity and Infrastructure Security Agency (CISA) keeps that list of flaws confirmed in attacks.
“Disclosure does not equal weaponization,” wrote Kri Dontje and Yves Younan. Younan directs vulnerability discovery, detection, and testing at Talos.
Microsoft’s releases show the gap. Its September Patch Tuesday carried 975 vulnerability advisories, by Talos’s count. Attackers had exploited three of them in the wild. October’s release carried 1,415, with 85 rated critical and one exploited, Talos reported on Oct. 13. Before June, Microsoft averaged about 100 a month, Talos says.
Talos is Cisco’s threat intelligence unit. Its post recommends Cisco’s LiveProtect and SnortML tools to cover the gap between disclosure and patching.
AI Vulnerability Discovery Is Mining Old Code
Talos credits frontier AI models, including Anthropic’s Mythos, which it says arrived in April. The models are working through decades of old code in widely used libraries and tools. They find known types of flaws more efficiently. They have not found a new class of vulnerability, Talos says.
That points to a peak, the researchers argue. Format string flaws emerged as a new class in 2000. Discoveries climbed until 2005, then declined. Talos expects AI-found flaws to follow a similar curve. AI will work through the backlog of old code, and it can check new code before release.
Why Known Exploited Vulnerabilities Grow More Slowly
Attackers need only enough working flaws to reach their targets, Talos says. They reuse the same ones against many organizations. The KEV list counts distinct flaws, not attacks or breaches.
Old flaws still do much of the damage. More than a third of actively exploited vulnerabilities trace back to 2025 or earlier. Talos’s Thorsten Rosendahl reported that in a separate analysis on Oct. 15.
The KEV list also trails attacks. CISA adds a flaw only once it has evidence of exploitation. Flaws disclosed this fall may join the list later. And attackers can now use AI to read vendor patches and find the flaws behind them faster, Talos warns.
Vulnerability Disclosure Under Strain
For years, researchers have given vendors about 90 days to fix a flaw before going public. Some now publish at once, Talos says. They argue that if one AI can find a flaw, any AI can.
Open-source projects are getting flooded with reports. Large vendors can handle the pressure for now, Talos says. Britain’s National Cyber Security Centre warned in April that organizations should prepare for a wave of urgent updates.
What Known Exploited Vulnerabilities Mean For Cyber Insurance
Talos advises defenders to focus on the flaws most exploitable in their own environment. Some insurers already work that way. Coalition now alerts policyholders to zero-days under active attack.
The volume also tests a common application question. Cyber insurance applications often ask how quickly a company patches critical flaws. Microsoft’s October release alone carried 85 critical flaws, by Talos’s count. At that volume, a promise to patch every critical flaw within a set window gets harder to keep.
FAQ – Known Exploited Vulnerabilities
How fast are software vulnerabilities growing?
Published CVEs rose 105% from a year earlier, according to Cisco Talos. Additions to CISA’s Known Exploited Vulnerabilities catalog rose 37% over the same period.
What is the Known Exploited Vulnerabilities catalog?
A list kept by the Cybersecurity and Infrastructure Security Agency of flaws with evidence of exploitation in real attacks.
How many Microsoft flaws were exploited recently?
By Talos’s count, three of 975 September advisories and one of 1,415 October advisories had been exploited in the wild.
Why are vulnerability counts rising?
Frontier AI models are finding known types of flaws in decades of old code, Talos says. They have not found a new class of vulnerability.
Will the surge last?
Talos expects it to level off once old code is worked through and AI checks new code before release, as format string flaws did after peaking in 2005.
What does this mean for cyber insurance?
Volume alone says little about attack risk. Exploitability matters more. Applications that ask how quickly companies patch critical flaws face a much higher monthly count.
Related Cyber Insurance News Posts
- Cyber Losses Run Up To 140 Times The Top Insurance Claims, Cyberwrite Finds
- At-Bay 2025 InsurSec Rankings Reveal Email Security Weaknesses Amid Rising Cyber Insurance Claims(Opens in a new browser tab)
- Agentic AI Cybercrime Surges 1,500% In New Flashpoint Threat Report(Opens in a new browser tab)
- Patch Management And Cyber Insurance: What The Adobe Reader Zero-Day Reveals(Opens in a new browser tab)
- 2025 Cybersecurity Readiness Report: 96% of Firms Still Unprepared for AI-Driven Threats, Cisco Finds(Opens in a new browser tab)
1 thought on “Vulnerability Counts Doubled. Exploited Flaws Rose 37%, Talos Says.”