KEVIntel CEO Details AI's Role in Exploit Verification and the Patching Race
KEVIntel CEO Ryan Dewhurst discusses the challenges of identifying and verifying exploited vulnerabilities amidst a surge in AI-generated exploit code and the increasing difficulty of timely patching.
Ryan Dewhurst, CEO of KEVIntel, has shed light on the intricate process his team employs to identify and verify exploited vulnerabilities that have not yet been officially cataloged by CISA. Their methodology involves a sophisticated global honeypot sensor network, AI-driven triage, and rigorous human verification in a lab environment before any findings are disseminated.
Dewhurst also addressed the implications of CISA's Binding Operational Directive (BOD) 26-04, which mandates a strict three-day patching deadline for actively exploited, automatable, and internet-facing vulnerabilities for federal agencies. He highlighted the utility of virtual patching as a temporary measure to mitigate risks while permanent fixes are implemented, and cautioned about the increasing complexity introduced by AI-generated proof-of-concept (PoC) code that can muddy the waters of exploit verification.
For the private sector, CISA's Known Exploited Vulnerabilities (KEV) catalog serves as a crucial indicator of exploitation, though Dewhurst emphasizes it should not be considered exhaustive. He acknowledged that large organizations like CISA may face operational speed limitations and that their focus is primarily on U.S. federal agencies. The sheer volume of new CVEs—averaging around 200 per day and escalating with AI advancements—makes comprehensive patching an almost insurmountable task, reinforcing the need for prioritization.
The three-day patching window imposed by BOD 26-04 is particularly ambitious, given that patch management often involves multiple stakeholders and change management processes. Organizations frequently struggle with basic asset management, which can significantly delay the identification and remediation of vulnerabilities, especially when effective asset inventories are lacking.
Attackers, however, are not constrained by these timelines. Dewhurst noted a trend of attackers accelerating their pace, leveraging AI to reverse-engineer patches and weaponize vulnerabilities at unprecedented speeds. This escalating threat landscape necessitates more agile defense strategies.
Virtual patching, often implemented through Web Application Firewall (WAF) rules, offers a temporary reprieve by blocking attack attempts while organizations work on applying official patches. While not a permanent solution and subject to imperfections, it provides critical time for remediation, as seen in recent instances where it helped mitigate exposure to WordPress Core RCE chains.
Dewhurst also touched upon the dual pressures vendors face regarding exploitation claims—both inflating and suppressing them. He cited examples where vendors might downplay a vulnerability's severity by claiming it requires authentication, only for closer inspection to reveal anonymous, unauthenticated exploitation is possible, or by including incident-derived Indicators of Compromise (IoCs) in advisories while denying in-the-wild exploitation. Ultimately, customers bear the brunt of this confusion, often left to play catch-up as the full truth emerges.
Regarding false positives, Dewhurst pointed to the common issue of AI-generated PoCs that appear convincing but do not actually exploit a vulnerability, citing CVE-2026-25089 in Fortinet FortiSandbox as an example. Distinguishing genuine exploitation from "AI-slop" requires meticulous technical reproduction, often relying on subtle clues in PoC documentation and the reputation of the researcher, but technical validation remains the ultimate arbiter.