CVE volume is up sharply, but the number of vulnerabilities that reach the CISA KEV catalog is not. Verizon DBIR's Alex Pinto and Qualys TRU's Saeed Abbasi ask what AI is really changing. Follow Qualys on BrightTALK for more Cyber Risk Series talks: https://www.brighttalk.com/channel/11673 Explore the Qualys Enterprise TruRisk Platform: https://www.qualys.com/etm Build your Risk Operations Center (ROC) today: https://www.qualys.com/roc Alex Pinto, Director of Threat Intelligence for the Verizon DBIR, and Saeed Abbasi, Head of the Qualys Threat Research Unit, follow up on the 2026 DBIR, where exploitation of vulnerabilities became the top initial access vector for the first time in the report's 19-year history. They revisit the Qualys analysis of more than a billion CISA KEV remediation records across four years: teams are patching faster, but volume is outgrowing capacity. Then they ask what AI is changing. CVE volume is already about 31% above all of last year, led by a handful of large software vendors, yet the number of vulnerabilities added to the KEV has not grown, and the KEV has held under 1% of reported CVEs. They look at whether new vulnerability types differ (authentication bypass and access control up, SQL injection and cross-site scripting down), whether attackers are shifting to different products, and why OT and ICS devices may be next. The takeaway: prioritize by what you own, not by who might attack you. Speakers: Alex Pinto, Director of Threat Intelligence, Verizon DBIR, and Saeed Abbasi, Head of Threat Research Unit (TRU), Qualys Chapters: 0:00 Introductions 0:18 The question: do more CVEs mean more risk? 1:39 DBIR 2026 recap: exploitation is the top initial access vector 2:36 A billion CISA KEV remediation records across four years 4:09 Survival analysis: how fast vulnerabilities burn down 5:25 The 2025 regression 8:37 Why mean time to remediate misses unpatched vulnerabilities 10:32 Mature programs fix vulnerabilities before they reach the KEV 12:11 What AI is changing: CVE volume already 31% above all of 2025 14:31 Why KEV additions have not grown 16:13 Fewer than 1% of vulnerabilities are weaponized 18:21 Who is publishing the new CVEs 20:01 Large software vendors lead the growth 21:32 Is this a Y2K effect? 23:33 The KEV as a popularity contest 24:50 Ransomware and edge devices in the KEV 26:15 Are we finding different kinds of vulnerabilities? 31:03 OT and ICS devices: a third hypothesis 34:25 Bottom line: prioritize by asset, not by actor 36:48 Closing and a call for data #CyberRiskSeries #VerizonDBIR #CISAKEV #Qualys

 67      1