Cyber Apocalypse Overblown? Study Shows AI-Found Vulnerabilities Are Rarely Exploited

New research is pushing back against the narrative that AI-powered hacking is already overwhelming enterprise defenses. A report from VulnCheck finds that the vast majority of vulnerabilities discovered using AI tools have not translated into active real-world exploitation.

The Details

VulnCheck analyzed whether AI-assisted vulnerability discovery is actually driving a measurable increase in attacks. The findings suggest the answer, at least for now, is largely no.

Key takeaways from the research:

• Most AI-identified vulnerabilities remain unweaponized, meaning attackers have not built working exploits around them
• The gap between vulnerability discovery and actual exploitation remains wide, even as AI accelerates the discovery side
• The research challenges the assumption that faster vulnerability identification automatically leads to faster or more frequent attacks

The report does not dismiss AI-driven threats entirely. It notes that the landscape is shifting and that the window between discovery and exploitation could narrow as attacker tooling matures. But the current data does not support the more extreme predictions of an imminent AI-fueled cyber crisis.

Why This Matters for Service Providers

For MSPs and telecom resellers, this research offers a useful calibration check. Vendor marketing around AI-powered threats can push businesses toward reactive, expensive security purchases that may not reflect actual current risk levels.

The more actionable insight is this: the threat is real but still developing, which means there is time to build measured, layered security practices rather than panic-buying point solutions. Service providers who can help clients understand the actual risk environment, rather than the headline risk, will build more trusted advisory relationships.

If you are already thinking about how AI fits into your broader service stack, the MSP Revenue Stacking: Voice, Security, and AI as Your Three Growth Pillars framework is worth reviewing. Security remains a pillar, but context matters when positioning it to clients.

It is also worth noting that the Five Eyes Warning: AI Set to Outpace Cybersecurity Systems in Months signals that government agencies are watching this space closely. Regulatory and compliance pressure on service providers may intensify regardless of whether the attack volume materializes immediately.

Looking Ahead

Watch for follow-on research that tracks whether exploitation rates begin to catch up with AI-assisted discovery rates over the next 12 to 18 months. If that gap closes, the threat calculus for service providers will shift significantly and quickly.

For the full story, read the original article on UC Today.