The AI landscape doesn't move in one direction — it lurches. Some techniques leap from experiment to table stakes in a single quarter; others stall against regulatory walls, technical ceilings, or organisational inertia that no amount of hype can dislodge. Knowing which is which is the hard part. The State of Play cuts through the noise with a rigorously maintained index of AI techniques across every major business domain — classified by maturity, evidenced by real-world adoption, and updated daily so you always know where you stand relative to the field. Stop guessing. Start knowing.
A daily newsletter distilling the past two weeks of movement in a domain or two — delivered to your inbox while the index updates in the background.
Each dot marks the weighted maturity of practices within a domain — hover for a brief summary, click for more detail
AI that continuously scans for vulnerabilities, monitors the attack surface, and prioritises remediation based on exploitability and exposure. Includes risk-based vulnerability ranking and external attack surface discovery; distinct from penetration testing which actively attempts exploitation.
Vulnerability and attack surface management has matured into a proven operational discipline with GA tooling, analyst recognition, and documented ROI. The question facing most organisations is not whether to adopt it, but how to close the persistent gap between discovery and remediation. Platforms from Qualys, Rapid7, and Tenable can surface thousands of vulnerabilities daily across cloud, on-premises, and SaaS environments. Analyst frameworks from GigaOm, IDC, Forrester, and SANS have formalised evaluation criteria, and the CAASM market is projected to reach $12.6B by 2033.
The technology works, but it has fundamentally failed. The constraint is not discovery but remediation physics. Empirical research from May 2026 on 500K+ vulnerability reports (HackerOne) shows discovery velocity up 76% YoY while remediation throughput collapsed 46%, creating a widening exposure debt. More critically: Mandiant's incident response data (500K+ investigation hours) found the mean time-to-exploit is now -7 days—exploits are weaponised and active BEFORE patches are released, rendering patch-based defense obsolete. The asymmetry is structural: AI-driven discovery (10-40x faster), PoC generation (60x faster), and weaponisation (172,000x faster) now exceed enterprise patch deployment (45-90 days) by orders of magnitude. Qualys analysis of 1B+ remediation records across 10,000 organisations shows critical vulnerabilities remaining open at Day 7 increased from 56% to 63%, with manual remediation failing 88% of the time—evidence the operational model has hit a structural ceiling. Remediation capacity hasn't merely stalled—it has degraded: analysis shows remediation times increased 47% over five years (171→252 days), and organisations can remediate only 1 in every 10 CVEs monthly. Alert fatigue affects 90% of teams, and fewer than one in four use advanced prioritisation methods like CISA KEV or EPSS. The CVSS-based strategy achieves only 3.96% efficiency despite 82% coverage. June 2026 data hardened the finding: Cloud Security Alliance research confirms vulnerability exploitation has become the #1 initial access vector at 31% of breaches (up from 20% prior year, a 55% increase), displacing credential abuse; only 26% of critical CISA-tracked vulnerabilities are fully remediated; median remediation time increased to 43 days (up from 32 days). Regulatory response is accelerating: FedRAMP Notice 14 (effective December 2026) replaces flat 30-day patch windows with risk-based remediation, requiring critical vulnerabilities addressed within 12 hours. Agentic AI remediation is emerging as operational necessity: Atlassian's DevSecOps platform achieved 51% automated vulnerability remediation at scale. However, market signal is mixed: Cobalt's 2026 pentesting survey shows trust in AI automation collapsed from 29% to 9% of organisations relying entirely on it, with 78% reporting fully automated tools miss critical vulnerabilities—indicating organisations are shifting toward hybrid human+AI models. For well-resourced enterprises with embedded automation, autonomous remediation, and continuous risk management loops, the practice delivers ROI. For everyone else, the practice has become a compliance theatre generating activity metrics disconnected from actual security outcomes.
Qualys leads the vendor field with 54%+ customer penetration and $669.1M in 2025 revenue, backed by 88% user recommendation rates. Its MITRE ATT&CK integration has reduced vulnerability scope by 85% for adopters, and comprehensive VMDR deployments report 403% three-year ROI. Tenable Nessus remains broadly deployed across 43,000+ organisations, while Rapid7 has expanded its platform through the Noetic acquisition for asset inventory and AI-driven attack coverage targeting GenAI vulnerabilities. GigaOm's 2026 Radar evaluated 32 ASM vendors, recognising Bishop Fox as a leader for its human-in-the-loop exploitation methodology -- a sign that the market is consolidating around differentiated approaches rather than feature parity. Gartner's 2026 Magic Quadrant recognizes Tenable as a Challenger in cyber-physical systems protection with unified exposure visibility across IT, cloud, identity, and OT assets.
Regulatory pressure reinforces adoption. Federal FISMA M-24-04 zero-trust mandates have driven enterprise-scale ASM deployments, with Qualys CSAM discovering 100K+ domains and 3M+ subdomains for individual customers. SANS published formalised ASM evaluation frameworks in late 2025, cementing the practice's institutional standing.
May 2026 empirical research crystallised the nature of the remediation crisis. HackerOne analysis of 500K+ vulnerability reports showed discovery submissions up 76% YoY but resolution rate down 46%—the opposite trajectory needed. Unresolved critical vulnerabilities grew 25x, creating exponential exposure debt. Mandiant's incident response dataset (500K+ hours, 2025 investigations) found median time-to-exploit at -7 days: exploits are weaponised before patches are released. Meanwhile, Lyrie research quantified the velocity asymmetry: AI discovery 10-40x faster, PoC creation 60x faster, weaponisation 172,000x faster, but enterprise patch deployment flat at 45-90 days. Remediation time per organisation has degraded 47% over five years (171→252 days), and capacity is fundamentally bottlenecked at 1-in-10 CVEs per month. Vendor innovation shifted toward autonomous remediation and data-aware prioritisation: Rapid7's Kenzo Security agentic AI agents achieve 94% investigation time reduction; Qualys integrates Data Security Posture Management to prioritise by breach impact; ServiceNow (which acquired Armis for $7.75B) orchestrates multi-rule workflows. Platform vendor commitment intensified: Microsoft Defender EASM and Security Exposure Management GA with native cloud integration; Qualys VMDR and CNAPP on Oracle Cloud Marketplace. Yet practitioner critique from the JupiterOne Industrial Complex analysis documented the discipline's fundamental misalignment—CVSS strategies require 57.4% of remediation effort for 3.96% efficiency. The constraint is not discovery but remediation and measurement discipline.
June 2026 findings validated and extended the May crisis narrative. Verizon's 2026 DBIR (22,000+ breaches across 145 countries) shows vulnerability exploitation as primary initial access vector (31%, up 55% YoY from 20%), the first 19-year inversion of the credential-abuse dominance pattern. Real-world sensor data from GreyNoise documented pre-disclosure reconnaissance activity on internet-facing assets 8-39 days before public CVE disclosure, with 11-day median lead time—indicating organized adversary activity ahead of vendor patches. Microsoft's June patch cycle hit record-breaking scale (206 CVEs, 33 critical) with mean time-to-working-exploit at 21.5 hours post-disclosure; the record was driven by 100+ AI agents in Microsoft's MDASH platform discovering new flaws. CrowdStrike threat data confirms 42% YoY increase in zero-day exploitation before public disclosure and 89% surge in AI-enabled adversary operations. The bottleneck evidence persists: only 26% of CISA-tracked critical vulnerabilities achieved full remediation (down from 38%); median patch time rose to 43 days (up from 32 days). Scanner coverage gaps remain endemic: 55.7% of critical CVEs receive no scanner coverage at all, and 62% of real-world exploits become available before scanner detection signatures ship. The National Vulnerability Database backlog swelled to 27,000+ unprocessed CVEs with 60,000+ projected for 2026 alone, per U.S. OIG audit. Industry response is shifting from traditional vulnerability management to Continuous Threat Exposure Management (CTEM)—Gartner positioning it as the new maturity framework, with organizations underestimating attack surface by 30% due to forgotten infrastructure, unmanaged assets, and cloud/SaaS sprawl. Supply chain risk has surfaced as critical: 65% of organizations experienced software supply chain attacks in 2026, with 454,000 malicious packages published to open-source registries (75% YoY increase).
The barriers remain structural. Edgescan data shows remediation cycles ranging from 63 days in software to 104 days in construction, and large enterprises leave 45.4% of vulnerabilities unaddressed. Unit 42's analysis of 750+ incidents found 87% of breaches spanning multiple attack surfaces with a 72-minute average exfiltration window -- far faster than most teams can respond. Practitioner analysis reveals endemic false positive epidemics (277 false-HIGH findings in single projects) exposing context-blindness as a root cause of scanner output misalignment with actual production risk. Tool reliability remains a recurring irritant: both Rapid7 InsightVM (CVE-2026-1814) and Tenable Nessus Agent (CVE-2026-2026) required emergency patches in February 2026. Practitioners have begun questioning the metrics themselves, arguing that vulnerability counts are poor proxies for risk reduction and incentivise activity over outcomes.
— Negative signal: Organizations relying entirely on AI automation for pentesting dropped 29%→9% YoY; 78% report AI tools miss critical vulnerabilities; LLM vulnerability MTTR rose 19→36 days; signal market correction away from pure automation toward hybrid approaches.
— Empirical analysis of 69,159 CVEs showing exploit timelines collapsed from 125 days to 0.5 days; 62% of critical vulnerabilities with working exploits circulated before any scanner shipped signatures; reveals structural maturity challenge in vulnerability detection approaches.
— Federal mandate (effective Dec 7, 2026) replaces 30-day patch cycles with risk-based model requiring critical vulnerabilities addressed within 12 hours; ecosystem-wide regulatory signal forcing adoption of AI-acceleration velocity requirements.
— Multi-year vulnerability and exploitation trend analysis (ProjectDiscovery, Mandiant, CrowdStrike, Google TIG): CVE volume explosion (30k→60k/year), mean time-to-exploit collapse (63 days 2018 → -7 days 2026), 70% of exploited bugs now zero-days, AI-assisted exploit generation 10-15 min/attempt.
— Real-world deployment: agentic AI embedded in Jira/DevSecOps workflow achieving 51% automated vulnerability remediation over 6 months; context-aware agents grounded in organizational knowledge deliver 44% higher accuracy than generic agents; demonstrates operational success of agentic remediation at scale.
— Large-scale empirical analysis (1B+ CISA KEV records, 10K organizations) showing critical vulnerabilities remaining open at Day 7 increased from 56% to 63%; manual remediation failed 88% of the time; demonstrates structural ceiling in human-driven operations.
— Record 206 CVEs (previous 175), 33 critical, mean time to exploit 21.5 hours post-disclosure; Microsoft MDASH orchestrates 100+ AI agents for discovery; volume trend 71% month-over-month increase.
— Sysdig metrics: risk prioritization achieved 75% YoY reduction in exploitable in-use vulnerabilities; VulnCheck data shows 2018 TTE 1 year, 2026 median 24 hours; agentic AI remediation emerging as operational necessity.