Rapid7 spotlights Gartner warning that AI narrows the flaw-to-attack window beyond patching speed

Rapid7 promoted Gartner’s Mythos report by Paul Proctor, John Watts and Emily Tan in a blog post on Oct. 22, 2026, warning that AI is collapsing the distance between theoretical weaknesses and executable attack scenarios. The Gartner report, Mythos Reprioritizes Cybersecurity Outcomes and Investments, bears the date May 28, 2026. daily.dev summarized the warning on Nov. 5, 2026, repeating the Mythos claim and the 2027 forecast.

Gartner says Mythos closes the distance between theoretical weaknesses and executable attack scenarios, pushing security teams to focus on results rather than activity. Gartner predicts that newer frontier-AI-enabled models will surpass Mythos by 2027, beginning a period of AI-assisted vulnerabilities and working exploits. Gartner notes its research publications are opinions, not statements of fact, and that Gartner does not endorse vendors, products, or services.

“Mythos collapses the distance between theoretical weaknesses and executable attack scenarios, forcing cybersecurity to optimize for outcomes, not activity,” Gartner said. The analyst firm urges a shift from volume and activity to speed of decision, response effectiveness, and measurable enterprise risk reduction as AI-driven attacker reasoning scales quickly. Gartner recommends tracking outcomes such as attack path analysis coverage, how frequently patching occurs, how fast teams deploy compensating controls, mean time to remediate, and technology debt.

Rapid7 says severity-based patching breaks down once the number of disclosures passes what teams can triage and the time from disclosure to exploitation shrinks to days or hours. Rapid7’s March 20, 2026, careers blog said its 2026 Global Threat Landscape Report found that the disclosure-to-exploitation window dropped from weeks to days and exploited high- and critical-severity vulnerabilities increased 105% year over year.

Rapid7’s Q2 2026 Quarterly Threat Landscape Report, “The compression era,” released August 18, 2026, recorded 8,539 high- and critical-severity CVEs at CVSS 7.0 to 10.0 in Q2 2026, twice Q2 2025’s 4,268. The same report counted 40 vulnerabilities newly exploited in the wild during Q2 2026. During Q2 2026, 62 percent of newly exploited vulnerabilities required no authentication, credentials, or user interaction, compared with 53 percent in Q2 2025. Disclosures of missing-authentication flaws tracked as CWE-306 rose 247 percent year over year, and proof-of-concept exploit code climbed 76 percent year over year, pushing the disclosure-to-weaponization gap toward zero.

Proof-of-concept exploit code increased 12 percent compared with the prior quarter, building on the 76 percent annual increase, according to Rapid7. During Q2 2026, each of 500 internet-facing assets saw 17 new high- or critical-rated vulnerabilities per quarter, roughly 8,500 patches in total; fixing 50 per week would require 170 weeks to clear the backlog. At Black Hat USA 2026, an autonomous system reviewed 3,915 open-source projects across two months and confirmed 14,090 flaws, 99.4 percent of which had not been reported before.

Rapid7 says AI-assisted tools scan open-source code faster and on a larger scale than human auditors can handle, and the rise in vulnerability disclosures is not the result of developers writing twice as many bugs. Rapid7 says the patching queue expands faster than it contracts, widening the divide between known and unfixed vulnerabilities each quarter. Every unpatched vulnerability carries a potential exploitation price tag, so the cost extends beyond labor, and a single exploited flaw can wipe out years of security spending for a mid-sized business.

The central insight of exposure management is to do things differently with the same resources, not to do more with less, Rapid7 says. Rapid7 defines traditional patching as identifying known flaws, ranking them by CVSS score, and applying fixes. Rapid7 calls holy grail flaws the most dangerous because attackers can exploit them remotely without any social engineering.

IBM’s 2026 Cost of a Data Breach Report found that AI-driven attacks increased breach costs by 56%, with the average breach cost topping $5 million in 2026. IBM said AI played a role in one in four breached organizations. Ransomware victims in Q2 2026 included Qilin at 263, The Gentlemen at 230, and DragonForce at 141; the United States faced the most attacks, with business services and healthcare hit hardest.

Rapid7’s incident response team tied 31.8% of incidents to social engineering and to ClickFix and fake CAPTCHA campaigns arriving through trusted platforms such as Microsoft Teams. APT (advanced persistent threat) clusters from Iran, North Korea, and Russia targeted government, finance, healthcare, manufacturing, energy, and telecommunications. Russian APT activity concentrated on edge infrastructure and SOHO (small office/home office) routers for DNS hijacking, and Iranian activity aimed at industrial control systems and operational technology.

Initial access is moving away from phishing and toward exploitation of unpatched internet-facing vulnerabilities, meaning employee click training alone is no longer sufficient. Rapid7 says a CVSS score shows how severe a flaw could be if exploited but does not show whether a flaw is reachable, requires authentication, or has existing exploit code. Rapid7 points to MLflow and FUXA SCADA vulnerabilities as urgent even though they lack the highest CVSS scores, since attackers were already exploiting them.

“Security teams are chasing ghosts if they think they’re ‘secure’ just by closing tickets based on CVSS scores,” said Christiaan Beek, Vice President of Rapid7 Labs. Rapid7 says the patching queue shrinks from thousands of CVEs to only the dozens that matter. Rapid7 says teams cannot patch every high- and critical-severity CVE and must choose exposures to close based on business impact, asset criticality, and attacker behavior.

Exposure management means knowing which assets are internet-facing, which vulnerabilities sit on them, and which are reachable without user interaction. Rapid7 urges a move from reactive patching to preemptive security: continuous exposure monitoring, attack-surface reduction before disclosure, and automated real-time detection and response. Rapid7 says pressure grows when leaders handle more vulnerabilities than their teams can fix, because separate weaknesses quickly form credible attack paths.

Rapid7 recommends triaging by exploitability rather than severity, ranking internet-facing, authentication-free, and proof-of-concept-available flaws. Rapid7 says leaders should view exposure through an attacker’s lens: reachable weaknesses, how they combine, affected business services, and the action that reduces risk most. Rapid7 says counting vulnerabilities, measuring backlog size, and setting generic remediation targets track finished work but do not show whether attacker options shrank or response and recovery got better.

Gartner recommends using attack path analysis to rank patches, virtual patches, and compensating controls, focusing on critical services linked to critical business outcomes and exposure. Gartner urges a shift from volume and activity to speed of decision, response effectiveness, and measurable enterprise risk reduction as AI-driven attacker reasoning scales quickly. Rapid7 says outcome-driven measures help leaders connect security spending to lower exposure, quicker action, and stronger business resilience.

Rapid7’s Project Glasswing tested Claude Mythos Preview and found flaw identification is only the start; teams need affected-system knowledge, business context, the right control, verification, and detection. Rapid7 says its vulnerability management tools unite attack-surface visibility, threat intelligence, business context, and attack-path analysis so teams can identify important exposures and coordinate remediation. Rapid7 is offering complimentary access to Gartner’s Mythos report so security leaders can reassess exposure prioritization and infrastructure teams can reassess response and recovery planning.

Prioritization matters only if teams can actually act on the results, Rapid7 says. Outcome-led programs let executives see which attacker opportunities shrank and how fast the organization could respond. Outcome-led programs support choices about technical debt, recovery planning, and how to deploy limited resources for the biggest cut in business risk.

Attackers use AI to refine phishing, scripting, and problem-solving, Rapid7’s 2026 Global Threat Landscape Report says. The report says organizations have lost the predictive lead time they relied on to assess and patch vulnerabilities. Rapid7 says security teams must act more intelligently by managing exposure and setting realistic priorities before attackers can exploit vulnerabilities.

Rapid7’s engineering teams build AI-powered defense tools that prioritize risk and combine detection with remediation, drawing on vulnerability publication data and frontline incident response telemetry. Rapid7’s security analysts turn data from collapsed exploitation timelines into immediate protection for businesses worldwide. Rapid7 says major breaches are mainly caused by delayed remediation and poor prioritization, making preemptive controls and integrated exposure management with threat detection essential.

Rapid7’s Q2 2026 report describes an OpenAI autonomous cyberattack where artificial intelligence found and weaponized a zero-day faster than human patching teams could respond. Weak or missing MFA-driven identity exposure served as the top intrusion path in 44 percent of incidents, while industrialized ransomware made up 42 percent of investigations. APT groups are refining evasion with Living Off the App/Land techniques.

Rapid7 says CVSS-based prioritization worked when teams had weeks to patch, since high-severity flaws were fixed first. Under the old model, medium-severity flaws waited, and low-severity flaws might never receive patches. Rapid7’s Q2 2026 Quarterly Threat Landscape Report draws on the company’s threat intelligence, vulnerability research, and incident response data.