{"id":16853,"date":"2026-10-22T18:27:41","date_gmt":"2026-10-22T18:27:41","guid":{"rendered":"https:\/\/newestek.com\/?p=16853"},"modified":"2026-10-22T18:27:41","modified_gmt":"2026-10-22T18:27:41","slug":"security-teams-urged-to-center-defense-on-the-single-profile-attackers-target-most","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16853","title":{"rendered":"Security teams urged to center defense on the single profile attackers target most"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Attackers are increasingly focusing on a limited range of critical vulnerabilities to run attacks with flaws packaged into exploits within as little as three days.<\/p>\n

Rapid7\u2019s latest Quarterly Threat Landscape report<\/a> found the number of newly exploited vulnerabilities in Q3 of 2026 was 43, up 19% year on year.<\/p>\n

Douglas McKee, director of vulnerability intelligence at Rapid7, said it would be wrong to interpret that 19% as indication of a \u201cslow, steady climb in exploitation,\u201d however.<\/p>\n

\u201cNew high-severity CVEs, the ones rated 7 through 10, are up 133% year over year, and publicly available proof-of-concept code is up around 86% over the same stretch,\u201d said McKee. \u201cSo the pile of things that could be exploited is growing far faster than the set of things attackers are actually choosing to exploit.\u201d<\/p>\n

Expedited exploit production line<\/h2>\n

Rapid7 also found that the majority of underground forum<\/a> posts referenced CVEs already in vendor advisories or in the US Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog within days of disclosure.<\/p>\n

This indicates rapid commercial repackaging of known flaws rather than a wave of genuinely novel zero-day sales, according to Rapid7.<\/p>\n

\u201cAI tooling is surfacing flaws quicker than any team can realistically triage them, but adversaries are still being picky about which ones they pick up and weaponize,\u201d McKee said.<\/p>\n

Attackers exploited select high-severity flaws within an average of three days, with 71% of the exploitation tracked by Rapid7 landing within a week. Vulnerabilities that require no authentication and little or no user interaction are favored for remote exploitation.<\/p>\n

Defenders need to adapt<\/a> to a world where high-severity flaws are packaged into exploits in days rather than weeks.<\/p>\n

\u201cOnce a new high-severity flaw goes public, you\u2019ve got roughly 72 hours before someone is using it in the wild, and attackers aren\u2019t casting a wide net while they do it,\u201d said McKee.<\/p>\n

The profile attackers target most<\/h2>\n

These days attackers are shopping in one aisle: remote, unauthenticated, and zero-click exploits.<\/p>\n

Rapid7\u2019s study found that nearly 80% of what got exploited this quarter could be reached remotely, with no login required and nothing for the victim to click<\/a>.<\/p>\n

\u201cIf your patching cadence still has the word \u2018monthly\u2019 in it, you\u2019re defending against an adversary who abandoned that schedule a long time ago,\u201d McKee warned.<\/p>\n

Rather than attempting to patch everything faster<\/a>, security teams should prioritize patching based on risk management questions and issues specific to their environments. Given attackers\u2019 current preferences, security leaders should identify systems that are exposed to that remote, unauthenticated, zero-click attacking profile, and consider how many days of exposure they are willing to accept on each of them.<\/p>\n

Concern over AI-orchestrated attacks rising<\/h2>\n

CSO parent company Foundry\u2019s forthcoming Security Priorities report found that AI-enabled attacks tops the list of security leaders\u2019 threat concerns, with 45% of CISOs rating their concern high.<\/p>\n

But in terms of what Rapid7 found, artificial intelligence showed up as an operational component in only about 8% of the attacks it tracked.<\/p>\n

\u201cIt was running the tactical middle of the attack, choosing the next technique or triaging which targets were worth the effort,\u201d McKee said of attacker AI use uncovered by Rapid7. \u201cIt wasn\u2019t deciding who to go after or why. A human still made that call.\u201d<\/p>\n

Still, other security experts warn of a growing wave of AI-orchestrated attacks.<\/p>\n

Nazar Tymoshyk, CEO of agentic AI security vendor UnderDefense, said that Russian APT groups are already running AI-powered attacks, and predicted more are coming.<\/p>\n

Russian and other APT group attackers often use Chinese models such as DeepSeek \u2014 which has few constraints or guardrails \u2014 and are often able to switch between models in running attacks, he said.<\/p>\n

Tymoshyk added that by running agentic attacks hackers can draw on a deeper pool of technical knowledge \u2014 expertise in database admin, CI\/CD pipelines, etc. \u2014 than can be commonly achieved by conventional human-only attack teams.<\/p>\n

Human teams tend to consist of various individuals that specialize in specific technical skills such as web app security or malware development, whereas abusing agentic tools gives attackers ready access to multi-skilled entities that they might not be able to easily recruit in human form.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Attackers are increasingly focusing on a limited range of critical vulnerabilities to run attacks with flaws packaged into exploits within as little as three days. Rapid7\u2019s latest Quarterly Threat Landscape report found the number of newly exploited vulnerabilities in Q3 of 2026 was 43, up 19% year on year. Douglas McKee, director of vulnerability intelligence at Rapid7, said it would be wrong to interpret that… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16853","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16853","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16853"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16853\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16853"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16853"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16853"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}