Qualys CISO Advises Shifting Focus from MTTR to Exposure Window Amidst AI-Driven Vulnerability Surge
Qualys CISO Nathan Smolenski advocates for a new metric, the Average Window of Exposure (AWE), to better manage the escalating volume of AI-discovered vulnerabilities and prioritize genuine threats.
The cybersecurity landscape is facing an unprecedented surge in vulnerability disclosures, largely fueled by advancements in artificial intelligence. Anthropic's Glasswing, for instance, identified over 6,000 high or critical severity issues in just 1,000 open-source software packages, while Mozilla found 22 issues in Firefox. Experts predict approximately 66,000 vulnerabilities will be reported this year alone. This dramatic increase in volume, coupled with AI's ability to link lower-severity flaws into potent remote code execution chains, presents a significant challenge for security teams.
In response to this evolving threat environment, Qualys CISO Nathan Smolenski argues that traditional metrics like Mean Time To Remediate (MTTR) are becoming insufficient. Instead, he proposes focusing on the Average Window of Exposure (AWE). This metric measures the time between when a confirmed exploit appears in an organization's environment and when the issue is validated as patched or closed. Unlike MTTR, which starts the clock at disclosure, AWE provides a more accurate picture of an organization's actual risk and the effectiveness of its security processes in mitigating active threats.
Smolenski emphasizes that hyper-prioritization, a key component of modern vulnerability management, builds upon existing practices of IT asset inventory, threat intelligence, and risk assessment. The critical difference lies in the real-time nature of this approach. Instead of relying on static, monthly spreadsheets, hyper-prioritization enables immediate responses to potential exploits, especially those targeted by automated, AI-powered attacks. This dynamic adjustment is crucial as new attack paths are discovered or exploit chains are developed.
The concept of evidence-based detection is also an evolution of traditional risk-based vulnerability management. While teams have historically relied on general scores like CVSS, evidence-based approaches incorporate specific business context and real-time threat intelligence. This allows organizations to understand the precise risk to their business-critical applications and focus remediation efforts where they will prevent the most potential financial loss.
Qualys's Threat Research Unit (TRU) research highlights the importance of this focused approach. In 2025, out of 48,172 disclosed vulnerabilities, only 357 (0.74 percent) were both remotely exploitable and actively weaponized by threat actors. This small fraction represents the true active risk that security teams should prioritize. However, Smolenski cautions that this landscape is fluid; a previously discounted vulnerability could become critical if new exploits emerge that bridge existing gaps, such as combining a local privilege exploit with a privilege escalation flaw.
Therefore, real-time updates to threat intelligence are paramount. Organizations must be aware of changing circumstances that make exploits possible, allowing them to adjust prioritization and remediation plans accordingly. While AI can identify vulnerabilities at scale, the ultimate responsibility for managing these risks and ensuring data relevance remains with the company.
Addressing the inherent nervousness around autonomous remediation, Smolenski outlines a trust-building mechanism. This involves supervised execution, robust rollback procedures, and reproducible evidence before accepting automated fixes. The goal is to ensure that automated patching processes are reliable and do not introduce new risks, thereby building confidence among seasoned IT professionals.