Cybersecurity has always been a race, but that race is being fundamentally redrawn.
Frontier AI models like Mythos and Daybreak are accelerating vulnerability discovery and exploit development at unprecedented speed, compressing timelines from months to hours. At the same time, organisations are overwhelmed by growing volumes of critical vulnerabilities while traditional prioritisation frameworks struggle to keep pace with real-world attacker activity.
The result is a rapidly widening gap between AI-speed exploits and human-speed defences.
According to the 2026 Verizon Data Breach Investigations Report, vulnerability exploitation now accounts for 31% of all breaches—the first time in 19 years it’s surpassed stolen credentials as the leading initial access vector. Meanwhile, the report states that the median time to patch critical CISA Known Exploit Vulnerabilities (KEVs) has risen from 32 to 43 days, while threat actors are already leveraging GenAI across more than 15 attack techniques.
Nearly 30% of vulnerabilities are weaponised within 24 hours, yet patch cycles still take weeks or months. Even more concerning, recent research found that the average time-to-exploit is now approximately negative seven days2, meaning attackers are exploiting vulnerabilities before patches are even released.
Together, these trends are leaving defenders struggling to keep up with attackers operating at machine speed.
The New Reality: Faster Exploits, Slower Defences
Three converging forces are driving today’s exposure crisis:
1. AI-accelerated exploit development
Frontier AI is dramatically compressing the timeline from vulnerability discovery to weaponisation. Every new feature, integration or system becomes a potential attack surface, and AI enables adversaries to find and exploit weaknesses faster than ever.
2. Traditional Prioritisation Models Are Falling Behind
Exploit timelines are shrinking dramatically. Public exploits often appear before official advisories, leaving defenders with little time to react. Security teams continue to rely heavily on severity scores and theoretical exposure models to determine what matters most. But high CVSS scores don’t necessarily reflect active exploitation.
Organisations need to know what attackers are targeting in the real world, not just what appears severe on paper.
3. Overwhelming volumes of critical findings
Tens of thousands of new CVEs are published each year, with many rated as ‘high’ or ‘critical’. Yet security teams cannot realistically patch everything immediately.
Without clear signals about real attacker behaviour, organisations are forced to choose between acting on incomplete intelligence or falling behind entirely, leading to delayed remediation, increased breach risk and operational disruption.
What Success Looks Like in the Age of AI-Driven Threats
To keep pace with AI-speed adversaries, organisations must adopt a fundamentally different approach: disrupting exploit-driven attacks earlier in the attack chain.
That means shifting from theoretical risk scoring to real-world exploit intelligence and immediate protection.
Prioritise based on real adversary activity, not theoretical risk.
Traditional scoring systems alone no longer suffice. Security teams need to focus on vulnerabilities that are actively exploited in the wild, not just those that appear severe on paper.
Stop Exploit-Driven Attacks Before Execution.
Organisations need real-time visibility into exploit delivery attempts, before payload execution, endpoint compromise or lateral movement occurs.
Get immediate protection during the patch gap
Patching takes time. Defence cannot wait. Organisations need continuously updated protection that reduces exposure while remediation is underway.
Operationalise Intelligence Across Existing Workflows
Exploit intelligence must integrate directly into existing tools, workflows and emerging AI-driven security operations to enable faster, more confident decisions.
Introducing Proofpoint Active Exploits Protection
Today, we’re introducing Proofpoint Active Exploits Protection—a new approach designed to help organisations identify and stop exploit-driven attacks before execution.
What fundamentally differentiates Active Exploits Protection from traditional endpoint, network and exposure-management solutions is its ability to provide best-in-class first-mile exploit protection through visibility into email, the primary entry point for many modern attacks.
Powered by visibility across more than 2 trillion annual email messages and a global sensor network, Proofpoint sees real attacker behaviour as exploits are being delivered. This enables organisations to identify exploit activity at the earliest stage of the attack chain before payload execution, endpoint compromise or lateral movement occurs.
While endpoint, network and exposure-management vendors prioritise vulnerabilities after discovery, Proofpoint perceives actual adversary intent through live attack telemetry. This provides organisations with earlier, higher-confidence insight into the threats attackers are actively attempting to exploit right now.
Key capabilities and benefits
1) Best-in-Class First-Mile Exploit Protection
Proofpoint delivers best-in-class first-mile exploit protection by identifying and preventing exploit activity at the email front door. This matters because many modern attacks begin with exploit delivery through email.
By observing exploit attempts in real time across both email and network telemetry, Proofpoint provides earlier visibility into attacker behaviour and active exploit campaigns than traditional endpoint or downstream detection approaches. This enables security teams to reduce exposure faster and act before compromise spreads.
2) Prioritise What Attackers Are Actually Targeting
Active Exploits Protection helps security teams prioritise vulnerabilities based on real-world attacker activity rather than theoretical severity scores alone.
By correlating exploit intelligence, network telemetry and observed attacker behaviour, organisations can focus remediation efforts on the vulnerabilities most likely to be exploited.
This reduces operational noise, improves prioritisation confidence and helps security teams focus resources where they matter most.
3) Immediate Protection During the Patch Gap—Not Just Insight
Insight alone doesn’t reduce risk. Action does.
Active Exploits Protection enables immediate protection through network- and email-based threat detection that can be deployed as soon as threats emerge. It delivers continuously updated network-based rulesets that integrate with existing infrastructure—including IDS, IPS and NGFW—to help organisations reduce exposure during the patch gap.
For Proofpoint customers, the exploit intelligence from Active Exploits Protection also enhances the threat detection capabilities within Proofpoint Core Email Protection, thereby strengthening defences against exploit-driven attacks delivered through email.
By extending protection across both network and email vectors, organisations can reduce exposure earlier while minimising operational disruption.
4) Make Faster, Threat-Informed Decisions
By enriching your security stack with real-time global threat intelligence and high-fidelity threat detection, Active Exploits Protection enables faster, more confident decision-making. Actionable insights on malicious IPs, domains, malware and campaigns are integrated directly into existing tools, allowing teams to prioritise and respond quickly. Continuous updates and reputation scoring ensure threat intelligence is always current, while reduced noise—such as false positives—improves overall effectiveness. Through flexible APIs, organisations can tailor exploit intelligence to their own workflows and operational priorities.
5) Scale and Streamline Operations with AI-Driven Workflows
Active Exploits Protection is designed to support modern, intelligence-driven security operations by enabling seamless integration with AI- and API-powered workflows. By embedding prioritised threat intelligence directly into automated processes, teams can accelerate decision-making and reduce manual triage. Emerging capabilities, including MCP and agent-based workflows, further streamline how intelligence is accessed and applied. This helps organisations keep pace with rapidly evolving threats.
Figure: Proofpoint Active Exploits Protection helps organisations reduce exposure faster with prioritised vulnerabilities and immediate protection.
Conclusion: A New Standard for Exposure Reduction
As exploit development accelerates in the age of AI, organisations need more than vulnerability prioritisation—they need the ability to identify and stop exploit-driven attacks before execution.
Proofpoint Active Exploits Protection represents a shift from reactive vulnerability management to proactive, threat-informed exploit protection. It delivers best-in-class first-mile exploit protection powered by real-world adversary telemetry across email and network traffic. By combining exploit intelligence, prioritisation and immediate protection into a unified operational approach, organisations can reduce exposure faster, improve operational focus and respond to exploit-driven threats with greater confidence.
The future of exploit protection belongs to organisations that can see and stop attacks earlier in the attack chain. And that’s exactly what Proofpoint is built to do.
To learn more about Proofpoint Active Exploits Protection—what it is, why it matters—take a look at our press release and website.