When a Vulnerability Score Isn’t Enough

According to a recent report covered by The Hacker News, security experts are warning that the time between a new vulnerability being disclosed and attackers weaponising it has shrunk dramatically. The rise of what they call “Mythos-class” artificial intelligence means cybercriminals can now craft working exploits faster than ever — sometimes within hours.

For years, Australian businesses have relied on severity scores to decide which flaws to fix first. A high score felt like a clear warning. But that logic no longer holds. A score tells you how bad a vulnerability could be, not whether it can actually harm your specific systems. The gap between “this might be dangerous” and “this is being used against us right now” is shrinking, and traditional weekly or monthly review cycles can’t keep up.

Why Proving Exploitability Matters More Than a Number

The core problem is speed. Attackers using AI can turn a disclosed Common Vulnerability and Exposure (CVE) into a working attack in days, sometimes less. Meanwhile, many security teams still validate risk on a schedule — every Friday, every month. That timing mismatch is where breaches happen.

Instead of asking “how severe is this CVE?”, the smarter question is: “Can an attacker actually exploit it in my environment?” That requires checking what systems are exposed, what attack methods the vulnerability enables, and whether existing security controls block them. This is not about guessing — it’s about evidence. Defenders need to prove a CVE is not exploitable before attackers prove the opposite.

For Australian small and mid-sized businesses, this shift is especially critical. Many SMBs run lean IT teams. They cannot afford to patch every medium-rated flaw just in case. Prioritising based on actual risk — not just a score — saves time and money. It also reduces the chance of a costly data breach.

What This Means for Australian SMBs

Australian SMBs face unique pressures: growing regulatory requirements like the Notifiable Data Breaches scheme, limited security budgets, and a rising tide of targeted ransomware attacks. A vulnerability that scores 9.8 but lives on a non-public, well-protected internal server might be less urgent than a 7.5 flaw sitting on a customer-facing web portal. Without proof of exploitability, you might waste resources on the wrong problem.

The takeaway is clear: waiting for a monthly patch cycle is too slow. Attackers don’t wait. Australian businesses need a faster, evidence-based way to validate which CVEs pose a real threat — and which can wait for the next scheduled update.

What You Can Do Now

  • Map each CVE to specific attack techniques. Instead of just reviewing the score, identify which kill-chain steps the vulnerability enables. Free resources like the MITRE ATT&CK framework can help you match CVEs to common tactics.
  • Check if affected assets are truly exposed. A vulnerability on a system that is properly segmented, firewalled, or air-gapped is far less risky. Update your asset inventory and network diagrams regularly.
  • Test your controls against those techniques — not the exploit itself. Run safe, simulated attacks that mimic the behaviours associated with the CVE. This tells you if your endpoint detection, email filtering, or access controls would stop the real thing.
  • Shorten your validation cycle. Move from weekly or monthly reviews to a daily or even on-demand process for high-priority CVEs. Automation tools can help scan for technique coverage and alert you to gaps.
  • Document your evidence. For each CVE you decide not to patch immediately, write down why — exposure status, existing controls, test results. This protects you during audits and helps you justify decisions to leadership.

These steps don’t require a massive security overhaul. They are practical, repeatable actions that any Australian SMB can start today. And if you need guidance, MS&VG’s cybersecurity advisors can help you build a faster, evidence-based vulnerability management approach tailored to your business size and sector.