//72,833
Disclosed CVEs
January–September 2026 in the selected data series [01]; not a global count of AI-discovered CVEs.
ZTC RESEARCH / INDEPENDENT RESEARCH
The New Cybersecurity Asymmetry
Artificial intelligence is accelerating vulnerability discovery and, in certain scenarios, narrowing the time available to protect systems against automated exploitation techniques. This context calls for reviewing regulatory criteria, updating and implementing internal policies, and continuously managing both exposure and its duration.
Exposure time is becoming an architectural decision.
Faster disclosure and demonstrated AI-assisted discovery challenge inherited security cycles. This report separates evidence, inference, and operational proposals to support decisions that organizations can verify.
43 days
Median time to full remediation
KEV-listed vulnerabilities in the Verizon DBIR 2026 sample (2025 data) [29].
≤ 4 h
Proposed containment target
A voluntary ZTC Research benchmark for extreme exposure, not a universally mandated deadline.
Discovery, disclosure, and exploitation must remain distinct: CVE counts alone cannot establish that AI caused a global rise in successful attacks.
Three findings with operational consequences
01
The pace of discovery is changing
Disclosure volumes increase in the examined data sources, while technical cases show real AI capability. A robust attribution of overall growth to AI remains unavailable.
02
Regulatory timelines require contextual interpretation
PCI DSS, CISA, ISO/IEC 27001, NIST, and related frameworks differ in scope. Meeting a patching window cannot substitute for immediate protection during active exploitation.
03
Resilience depends on tested controls
Workload identity, segmentation, least privilege, isolation, and verified remediation can constrain attack paths when effectively implemented and tested.
ZTC Research invites standards bodies, regulators, and organizations to review and update relevant criteria, and to translate internal policies into controls that are implemented, tested, measured, and continuously improved. Containment within hours is a risk-based technical proposal, not a blanket regulatory obligation.
Speed changes the exposure; architecture determines the impact
AI can accelerate selected stages of vulnerability discovery and analysis, narrowing organizations’ decision windows. Available evidence does not yet establish that AI accounts for overall global growth in CVE disclosures or successful incidents. A credible assessment must distinguish discovery, disclosure, exploitation, and actual harm.
Response requires three related capabilities: continuously understanding exposure, constraining impact through enforceable architectural boundaries, and remediating with traceable evidence. Quarterly or annual evaluation cycles remain useful compliance and assurance baselines; organizations can complement them with continuous monitoring, change-triggered assessments, and risk-prioritized scanning.
01 · Continuous visibility
Asset and attack-surface inventory, signals of active exploitation, significant changes, and configuration monitoring. Automated scanning with risk-adjusted cadence, authorized scope, and safeguards for business operations.
02 · Architectural containment
Segmentation, workload identity, least privilege, tenant isolation, egress controls, and constrained propagation paths to limit consequences even when a vulnerability is exploited.
03 · Verified closure
Interim protection where appropriate, definitive remediation, technical validation, and evidence of exposure duration, containment, recovery, and control effectiveness.
ZTC RESEARCH TECHNICAL PROPOSAL · NOT AN EXISTING MANDATORY STANDARD
CCA-01 · Architectural Impact Containment
Proposed control objective
Architecture should ensure that compromising a service, identity, or component does not automatically enable access to other systems, tenants, data, or critical functions. Effectiveness must be demonstrated through implemented boundaries and authorized testing of plausible compromise scenarios.
Segmentation and isolation
Separate networks, services, control and data planes, and tenant environments; restrict east-west traffic and egress by default.
Identity and authorization
Independent workload identities, short-lived credentials, least privilege, and per-resource authorization; negative tests must prevent lateral escalation from a compromised account.
Resilience and impact limits
Access boundaries, quotas, egress controls, component isolation, and graceful degradation mechanisms to protect essential functions.
Testing and evidence
Negative authorization and segmentation tests, authorized failure scenarios, enforcement telemetry, documented exceptions, and containment exercises with accountable owners.
Minimum evidence for a CCA-01 assessment
Inventory of data flows and trust boundaries; active network and authorization policies; negative access and isolation test results; alerts and logs; measured detection and containment times; accepted exceptions and retesting after significant changes.
Standards review and internal policies
ZTC Research invites standards bodies and regulators to review and update the adequacy of assessment criteria, minimum evaluation cadences and containment expectations in the face of rapidly evolving threats. Organizations can review, update and effectively implement their internal policies, supplement periodic assessments with continuous exposure monitoring and risk-based scanning, and measure containment performance in hours without waiting for a regulatory amendment.
Alignment with existing requirements and controls
PCI DSS 4.0.1
6.3.3 · 11.3.1/11.3.2 · 11.4.5/11.4.6 · A1.1.4
Critical patches; quarterly internal and external scanning; segmentation testing for CDE scoping (11.4.5 and 11.4.6 for service providers); and logical tenant separation where applicable (A1.1.4). CCA-01 proposes additional metrics for architectural containment of compromise.
ISO/IEC 27001/27002:2022
Annex A: 5.7 · 8.8 · 8.16 · 8.20 · 8.22 · 8.27 · 8.32
Threat intelligence, vulnerability management, monitoring, network security and segregation, secure architecture and engineering principles, and change management. Control selection and implementation depend on risk; these controls do not impose one universal patching deadline.
NIST CSF 2.0
ID.RA · PR.AA · PR.IR · DE.CM · RS.MI
Risk assessment, identity and access management, infrastructure resilience, continuous monitoring, and incident mitigation. CSF describes security outcomes without prescribing a single implementation or a universal four-hour target.
The cited identifiers refer to existing requirements and controls in their respective frameworks; CCA-01 and the proposed metrics are original ZTC Research recommendations. Applicability depends on system scope and risk profile. Active scans and penetration tests require authorization and production-safety planning.
Reports and citation resources
Full report · EnglishDownload (PDF)
Informe completo · españolDownload (PDF)
Citation and BibTeX (ES/EN)Download (.txt)
Method, scope, and limitations
Desk research drawing on public sources, disclosure series, and technical case studies. No original penetration tests, active scans, or forensic examinations were conducted. Quantitative claims are limited to each source’s definition and reporting window. The report distinguishes operational proposals from regulatory requirements.
[01] CVETodo data series. [29] Verizon DBIR 2026, 2025 reporting sample. Full bibliographic entries and limitations appear in the PDF.
How to cite
ZTC Research / Zero Trust Consulting (2026). The New Cybersecurity Asymmetry. Version 1.0. Report ZTCR–AI–VM–2026–01.
https://zerotrust.consulting/en/research/ai-cybersecurity-2026/Other ZTC publications
Mexico and the Post-Quantum Transition 2026 (PDF)
ZTC Cyber Intelligence · weekly magazine