Recorded Future Outlines a Playbook for Prioritizing AI-Driven Vulnerability Discoveries
Summary
Recorded Future recommends using threat intelligence to prioritize the small share of vulnerabilities it observes being exploited and describes faster detection and response workflows. Its processing-time and integration figures are vendor claims.
Key points
- Recorded Future says about 50,000 CVEs were disclosed in 2025, while its intelligence observed 446 being actively exploited in the wild.
- The article recommends prioritizing vulnerabilities using live risk, observed exploitation, ransomware-actor associations, and sector or campaign targeting.
- Recorded Future says its agentic processing can generate enriched intelligence and detection content in about 31 minutes; this is a vendor-reported figure.
- The company says Autonomous Threat Operations can distribute intelligence and actions across more than 100 integrations, including SIEM, EDR/XDR, and vulnerability-management tools.
- As an example, the article describes producing detection logic, exploit context, indicators, and remediation guidance for CVE-2025-55182 (React2Shell).
- Its recommendations include shortening disclosure-to-detection time, prioritizing threat intelligence over severity scores alone, and extending response across the technology stack.
Article Details
- Defense Focus
- Prioritize vulnerabilities using threat intelligence and move from disclosure to detection and response at machine speed.
- Detection Methods
- Generate detection signatures with documented logic, evidence specifications, and passive fingerprinting strategies.
- Correlate vulnerability disclosures and affected assets with evidence of active exploitation, threat-actor activity, ransomware association, and sector targeting.
- Continuously hunt for threats and deploy priority intelligence across connected defensive systems.
- Detect brand impersonation sites and exposed credentials, enrich findings with campaign or infection context, and verify that response actions succeeded.
- Data Sources
- Vulnerability descriptions, vendor advisories, and patch diffs
- Open- and dark-web telemetry
- Government advisories, including the CISA KEV catalog
- Primary research and observed exploitation evidence
- Vulnerability scanning and asset-inventory data
- Rule Types
- Production-ready detection signatures
- Detection rules
- Detection commands; no specific syntax or query language is identified
- Platforms
- SIEM
- SOAR
- EDR/XDR
- NGFW
- Vulnerability management platforms
- Threat intelligence platforms
- Identity and access management
- Email and cloud security
- Defensive Actions
- Prioritize remediation using live risk, active exploitation, threat-actor or ransomware association, and sector targeting rather than severity scores alone.
- Compress the disclosure-to-detection cycle and automate deployment of validated detections and response actions.
- Extend coverage beyond endpoints to application code, kernels, libraries, and cloud configurations.
- For exposed credentials, force password resets, revoke active sessions, alert affected users, and verify the response.
- For brand impersonation, coordinate takedowns, block at email and web layers, alert affected employees, and verify the takedown.
MITRE ATT&CK
CVE
Vendors
Products
Attack Surface Intelligence[T1595] Active Scanning – Passive fingerprinting and attack surface intelligence are used to identify vulnerable systems and exposures at scale; quoted as [‘passive fingerprinting strategy’ and ‘attack surfaceAutonomous Threat OperationsRecorded Future says its agentic processing and Autonomous Threat Operations can turn disclosures like CVE-2025-55182 React2Shell into deployable detections and actions within minutes.Digital Risk ProtectionRecorded Future’s Digital Risk Protection runs this loop continuously across the open, deep, and dark web.Identity Intelligence[T1078] Valid Accounts – Identity Intelligence focuses on exposed credentials, MFA cookie capture status, and revoking active sessions; quoted as [‘credentials tied to your environment’ and ‘revoke active sessions’]React Server Componentsattackers weaponize disclosed vulnerabilities against exposed systems, including React2Shell in React Server Components; quoted as [‘pre-authentication remote code execution vulnerability in React Server Components’Recorded Future IntelligenceRecorded Future Intelligence observed only 446 actively exploited CVEs in 2025 against approximately 50,000 disclosed — less than 1%.