The AI landscape doesn't move in one direction — it lurches. Some techniques leap from experiment to table stakes in a single quarter; others stall against regulatory walls, technical ceilings, or organisational inertia that no amount of hype can dislodge. Knowing which is which is the hard part. The State of Play cuts through the noise with a rigorously maintained index of AI techniques across every major business domain — classified by maturity, evidenced by real-world adoption, and updated daily so you always know where you stand relative to the field. Stop guessing. Start knowing.
A daily newsletter distilling the past two weeks of movement in a domain or two — delivered to your inbox while the index updates in the background.
Each dot marks the weighted maturity of practices within a domain — hover for a brief summary, click for more detail
AI that continuously scans for vulnerabilities, monitors the attack surface, and prioritises remediation based on exploitability and exposure. Includes risk-based vulnerability ranking and external attack surface discovery; distinct from penetration testing which actively attempts exploitation.
Vulnerability and attack surface management has matured into a proven operational discipline with GA tooling, analyst recognition, and documented ROI. The question facing most organisations is not whether to adopt it, but how to close the persistent gap between discovery and remediation. Platforms from Qualys, Rapid7, and Tenable can surface thousands of vulnerabilities daily across cloud, on-premises, and SaaS environments. Analyst frameworks from GigaOm, IDC, Forrester, and SANS have formalised evaluation criteria, and the CAASM market is projected to reach $12.6B by 2033.
The technology works, but it has fundamentally failed. The constraint is not discovery but remediation physics. Empirical research from May 2026 on 500K+ vulnerability reports (HackerOne) shows discovery velocity up 76% YoY while remediation throughput collapsed 46%, creating a widening exposure debt. More critically: Mandiant's incident response data (500K+ investigation hours) found the mean time-to-exploit is now -7 days—exploits are weaponised and active BEFORE patches are released, rendering patch-based defense obsolete. The asymmetry is structural: AI-driven discovery (10-40x faster), PoC generation (60x faster), and weaponisation (172,000x faster) now exceed enterprise patch deployment (45-90 days) by orders of magnitude. Remediation capacity hasn't merely stalled—it has degraded: analysis shows remediation times increased 47% over five years (171→252 days), and organisations can remediate only 1 in every 10 CVEs monthly. Alert fatigue affects 90% of teams, and fewer than one in four use advanced prioritisation methods like CISA KEV or EPSS. The CVSS-based strategy achieves only 3.96% efficiency despite 82% coverage. For well-resourced enterprises with embedded automation, autonomous remediation, and continuous risk management loops, the practice delivers ROI. For everyone else, the practice has become a compliance theatre generating activity metrics disconnected from actual security outcomes.
Qualys leads the vendor field with 54%+ customer penetration and $669.1M in 2025 revenue, backed by 88% user recommendation rates. Its MITRE ATT&CK integration has reduced vulnerability scope by 85% for adopters, and comprehensive VMDR deployments report 403% three-year ROI. Tenable Nessus remains broadly deployed across 43,000+ organisations, while Rapid7 has expanded its platform through the Noetic acquisition for asset inventory and AI-driven attack coverage targeting GenAI vulnerabilities. GigaOm's 2026 Radar evaluated 32 ASM vendors, recognising Bishop Fox as a leader for its human-in-the-loop exploitation methodology -- a sign that the market is consolidating around differentiated approaches rather than feature parity. Gartner's 2026 Magic Quadrant recognizes Tenable as a Challenger in cyber-physical systems protection with unified exposure visibility across IT, cloud, identity, and OT assets.
Regulatory pressure reinforces adoption. Federal FISMA M-24-04 zero-trust mandates have driven enterprise-scale ASM deployments, with Qualys CSAM discovering 100K+ domains and 3M+ subdomains for individual customers. SANS published formalised ASM evaluation frameworks in late 2025, cementing the practice's institutional standing.
May 2026 empirical research crystallised the nature of the remediation crisis. HackerOne analysis of 500K+ vulnerability reports showed discovery submissions up 76% YoY but resolution rate down 46%—the opposite trajectory needed. Unresolved critical vulnerabilities grew 25x, creating exponential exposure debt. Mandiant's incident response dataset (500K+ hours, 2025 investigations) found median time-to-exploit at -7 days: exploits are weaponised before patches are released. Meanwhile, Lyrie research quantified the velocity asymmetry: AI discovery 10-40x faster, PoC creation 60x faster, weaponisation 172,000x faster, but enterprise patch deployment flat at 45-90 days. Remediation time per organisation has degraded 47% over five years (171→252 days), and capacity is fundamentally bottlenecked at 1-in-10 CVEs per month. Vendor innovation shifted toward autonomous remediation and data-aware prioritisation: Rapid7's Kenzo Security agentic AI agents achieve 94% investigation time reduction; Qualys integrates Data Security Posture Management to prioritise by breach impact; ServiceNow (which acquired Armis for $7.75B) orchestrates multi-rule workflows. Platform vendor commitment intensified: Microsoft Defender EASM and Security Exposure Management GA with native cloud integration; Qualys VMDR and CNAPP on Oracle Cloud Marketplace. Yet practitioner critique from the JupiterOne Industrial Complex analysis documented the discipline's fundamental misalignment—CVSS strategies require 57.4% of remediation effort for 3.96% efficiency. The constraint is not discovery but remediation and measurement discipline.
The barriers remain structural. Edgescan data shows remediation cycles ranging from 63 days in software to 104 days in construction, and large enterprises leave 45.4% of vulnerabilities unaddressed. Unit 42's analysis of 750+ incidents found 87% of breaches spanning multiple attack surfaces with a 72-minute average exfiltration window -- far faster than most teams can respond. Practitioner analysis reveals endemic false positive epidemics (277 false-HIGH findings in single projects) exposing context-blindness as a root cause of scanner output misalignment with actual production risk. Tool reliability remains a recurring irritant: both Rapid7 InsightVM (CVE-2026-1814) and Tenable Nessus Agent (CVE-2026-2026) required emergency patches in February 2026. Practitioners have begun questioning the metrics themselves, arguing that vulnerability counts are poor proxies for risk reduction and incentivise activity over outcomes.
— Comprehensive indictment: remediation time degraded 47% over five years (171→252 days); capacity 1-in-10 CVEs/month; CVSS strategy achieves 3.96% efficiency despite 82% coverage—fundamental structural failure.
— Only vendor with Customers' Choice award in two consecutive years; independent customer satisfaction signal reflecting market confidence in unified exposure management platform maturity.
— Tenable received highest possible scores across breadth, exposure assessment, reporting, and benchmarking; Forrester evaluation validates structured market category with defined criteria for unified VM platforms.
— 500K+ incident response hours show mean time-to-exploit at -7 days (exploits weaponized before patches released); patch management as primary control demonstrably failed; lateral movement collapse from 8+ hours to 22 seconds.
— Analysis of 500K+ vulnerability reports shows discovery velocity up 76% YoY but monthly remediation rate fell 46%; cumulative backlog of unresolved criticals grew 25x, quantifying structural remediation capacity collapse.
— AI-driven discovery (10-40x faster), PoC creation (60x faster), and weaponization (172,000x faster) now exceed enterprise patch deployment (45-90 days) by orders of magnitude; demonstrates asymmetry invalidating traditional VM cycles.
— Q1 revenue $175.6M (+10% YoY), 47% EBITDA margin, Agent Val GA, partnerships with OpenAI/Anthropic; reflects production-scale VMDR adoption with autonomous remediation capability advancement.
— UK government official guidance establishes six foundational VM principles including policy, active exploitation response, asset identification, triage/prioritization, senior risk ownership, and verification—authoritative baseline.