AI Broke Vulnerability Management: Why CISOs Are Moving Budget to Breach and Attack Simulation

For thirty years, vulnerability management relied on a buffer between discovery and weaponization. AI has collapsed that buffer, compressing time-to-exploit from months to hours. Anthropic’s Claude Mythos Preview found over 10,000 high-severity vulnerabilities in one month, with 99% still unpatched. Meanwhile, attackers use AI to automate exploitation at machine speed. Verizon’s 2026 DBIR shows median fix time for known-exploited vulnerabilities has risen to 43 days, while the percentage fully patched dropped to 26%. Breach and Attack Simulation (BAS) offers a solution by validating which vulnerabilities are actually exploitable in a given environment and whether existing controls block them. Gartner labels this shift Adversarial Exposure Validation. Picus Security’s agentic BAS platform autonomously maps threat intelligence to pre-vetted attack simulations, providing prioritized mitigations in minutes. This approach buys time for safe patching and focuses resources on genuine risks.