Qualys CISO Highlights AI‑Driven Vulnerability Surge and Calls for “Average Window of Exposure” Metric
What Happened — In a Help Net Security interview, Nathan Smolenski, CISO of Qualys, warned that AI‑assisted discovery is inflating both the volume and the severity of reported vulnerabilities. Real‑world telemetry shows more than 6,000 high‑or‑critical issues from Anthropic’s Glasswing scan of 1,000 OSS packages and 22 new bugs in Firefox, contributing to an estimated 66,000 CVEs reported in 2025. Smolenski argues that the traditional Mean Time To Remediate (MTTR) is the wrong KPI; instead, organizations should measure the Average Window of Exposure (AWE) – the time between an exploit’s presence in the environment and its validated remediation. He stresses that autonomous remediation must be backed by reproducible evidence, tiered asset reviews, and rollback safeguards to build trust in automated fixes.
Why It Matters for Trust & Control Assurance — The shift to AI‑generated findings tests the control objective of risk‑based vulnerability management and evidence‑driven remediation, a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected — SaaS security vendors, cloud‑hosted enterprises, and any organization that relies on automated vulnerability scanners.
Recommended Actions
- Adopt the Average Window of Exposure metric and report it alongside MTTR.
- Tier assets and require human review or automated rollback for high‑impact AI‑generated patches.
- Capture immutable evidence (scan logs, remediation tickets, rollback records) to demonstrate control effectiveness during audits.
Technical Notes
- AI‑driven scanners (e.g., Anthropic’s Glasswing) are producing >6 k high‑severity findings per 1 k packages.
- Remote code execution is increasingly linked to AI‑identified vulnerabilities, raising exploit likelihood.
- No specific CVE is cited; the discussion focuses on the emerging volume and quality shift.
Source: Help Net Security – Qualys CISO on AI‑driven vulnerability management