Verizon DBIR: Enterprises Face a Dangerous Vulnerability Glut

Why It Matters

The widening gap between vulnerability discovery and remediation heightens breach risk, forcing enterprises to rethink patching strategies and adopt AI‑driven defenses to protect critical assets.

Key Takeaways

• Exploitation became top initial access vector, up 31% YoY
• Only 26% of critical flaws fully patched in 2025
• Detection records grew eightfold from 2022 to 2025
• AI tools give attackers faster, cheaper exploit development

Pulse Analysis

The Verizon DBIR highlights a perfect storm: a flood of newly discovered vulnerabilities and a slowdown in remediation. Organizations now face an average median resolution time of 43 days—two weeks longer than the previous year—while the sheer number of critical bugs has risen by 50%. This mismatch inflates the attack surface, making traditional reactive patching insufficient and prompting security leaders to invest in more proactive, data‑driven vulnerability management programs.

Artificial intelligence is reshaping the threat landscape. Generative AI models enable threat actors to automate vulnerability research, craft exploits, and even generate malicious code at near‑zero cost. The report notes that attackers referenced AI assistance in 15 documented techniques on average, with some leveraging it in up to 50. This AI‑enabled asymmetry forces defenders to consider autonomous remediation workflows that can triage, prioritize, and remediate threats without human bottlenecks, shifting the balance back toward the defenders.

To stay ahead, enterprises should double down on fundamentals while integrating AI responsibly. Prioritizing patches based on active exploitation—using sources like CISA’s KEV list and exploitability prediction scores—ensures limited resources address the highest‑risk flaws first. Shifting detection left, automating remediation, and fostering a security‑first culture further reduce dwell time. By marrying disciplined patch management with intelligent automation, organizations can mitigate the vulnerability glut and protect against the accelerating AI‑driven threat vector.