Qualys CISO: AI-Found Flaws Drove Fewer Than 1% of 2025 Exploits

En bref

• Qualys CISO Nathan Smolenski addressed AI-assisted vulnerability discovery and exploitation trends in 2025.
• Such AI-found issues accounted for less than 1% of exploitation activity this year.
• He recommended monitoring exposure duration, tiering assets, keeping humans in the loop, planning rollbacks, and using autonomous remediation cautiously.

Qualys CISO Nathan Smolenski offered perspective on how artificial intelligence is changing vulnerability discovery and attack activity in 2025. He noted that flaws surfaced with AI assistance made up a very small share of exploitation observed during the year—fewer than 1%. No specific CVE was cited in the guidance, which is best treated as contextual risk information rather than a response to a named incident.

For K-12 and government IT teams, the takeaway is less about panic and more about process discipline. Organizations experimenting with AI-assisted security tooling should classify assets by criticality, measure how long exposures remain open, and require manual oversight before making changes on high-value systems. These controls matter even when the overall exploitation rate tied to AI-found issues is low, because a single missed critical asset can outweigh aggregate percentages.

Smolenski also emphasized reversion procedures and cautious use of self-directed patching. Automated fixes can reduce workload, but they can also introduce regressions if applied broadly without testing. Teams should pilot autonomous remediation only on low-risk systems, log every change, and keep rollback steps ready. Human validation of AI-generated findings remains important before action is taken.

The broader context is that AI-assisted discovery is not yet the dominant driver of exploitation in 2025. That may change, but current guidance favors measured adoption over hype. Watch for shifts in exploitation patterns, increases in AI-surfaced findings, and vendor updates on automation safeguards. In the meantime, exposure tracking, asset tiering, manual review, and rollback readiness provide practical defenses without overreacting to a small annual share.

À faire maintenant

1. Inventory and classify systems by business criticality so high-value assets receive stricter change control.
2. Measure and log how long vulnerabilities remain open; set remediation timeframes based on asset tier.
3. Require manual approval before any automated remediation touches critical or public-facing systems.
4. Test and document rollback or reversion procedures for every automated patch or configuration change.
5. Pilot autonomous remediation only on low-risk, non-critical systems with close monitoring and audit logs.
6. Validate AI-assisted vulnerability findings with human review before assigning remediation work.
7. Track exploitation trends and vendor guidance; adjust automation thresholds as new information emerges.

Source originale

Help Net Security