Supply Chain Vulnerability Risk Grows as Exploitation Outpaces Visibility

Summary

Black Kite’s 2026 report says over 48,000 CVEs were published in 2025, but only 58 of 1,024 prioritized CVEs were readily discoverable to attackers. The article examines shrinking patch windows, AI-related exposure and visibility gaps.

Key points

• Black Kite’s report says more than 48,000 CVEs were published in 2025.
• Of 1,024 prioritized CVEs selected using EPSS scores, KEV inclusion and third-party relevance, Black Kite identified 58 as readily discoverable to attackers through OSINT and critical to enterprise supply chains.
• Mandiant estimated mean time to exploit at -7 days in M-Trends 2026; the article says Black Kite reached a similar conclusion about exploitation occurring before patches are available.
• The article argues that AI may increase vulnerability discovery and software exposure; Black Kite’s Jeffrey Wheatman also warns that agentic tools can create hidden exposures through their access and authorization.
• Wheatman says autonomous defense involves tradeoffs: the article cites a faulty CrowdStrike configuration update that crashed about 8.5 million Windows systems and notes that high-impact systems may need human oversight.
• The article says SBOMs could improve software visibility, but questions their current completeness, accuracy and value; Wheatman says AI SBOMs remain at least a year away.

People