cyber.hendryadrian.com
Detection & Defense · bitsight.com

How Bitsight Uses AI to Speed Internet-Wide Vulnerability Exposure Discovery

· Original article ↗

Summary

Bitsight describes using AI-assisted product fingerprinting, internet-wide scans, and asset mapping to identify likely vulnerability exposure, then applying scans and exploitation forecasts to help defenders prioritize investigation and patching.

Key points

  • Bitsight says AI helps create product fingerprints more quickly, identifying products and, where possible, versions exposed by internet-facing services.
  • Continuous fingerprinting lets Bitsight search existing observations when a vulnerability is disclosed, including across subsidiaries and suppliers.
  • The company says vulnerability-specific scans can help verify whether an identified system has the vulnerable condition and appears exploitable.
  • Bitsight Groma scans public internet assets, while its Graph of Internet Assets links observed assets to likely owners and business relationships.
  • Dynamic Vulnerability Exploit Intelligence uses threat-intelligence signals to forecast exploitation likelihood, which Bitsight says can provide warning up to 90 days ahead.
  • The article advises using exposure and exploitation context to prioritize response alongside CVSS, CISA's KEV catalog, and established patching SLAs.

Article Details

Defense Focus
Accelerate internet-wide identification and prioritization of potentially vulnerable internet-facing products and versions, including assets in subsidiaries and third-party ecosystems.
Detection Methods
  • Continuously fingerprint products and versions exposed on the public internet, then apply new fingerprints to existing observations when a vulnerability is disclosed.
  • Run vulnerability-specific scans to assess whether the vulnerable condition is present and appears exploitable.
  • Match identified product fingerprints to known vulnerabilities and use exploitation-likelihood forecasting to prioritize investigation.
Data Sources
  • Public-internet observations of running software, open ports, misconfigurations, and vulnerabilities
  • Internet-facing asset and organization relationship data
  • Threat intelligence from the clear, deep, and dark web, including hacker discussions, exploit-code releases, malware kits, and active attack patterns
Rule Types
  • Product fingerprinting signatures
  • Vulnerability-specific scan checks
Platforms
  • Bitsight Groma
  • Bitsight Graph of Internet Assets (GIA)
  • Bitsight Dynamic Vulnerability Exploit (DVE) Intelligence
Defensive Actions
  • Use internet-wide fingerprinting to quickly identify likely exposure after a vulnerability disclosure, including exposure across subsidiaries, suppliers, and other third parties.
  • Investigate the most critical internet-facing systems first; validate initial fingerprint results with vulnerability-specific scans.
  • Prioritize remediation using exposure context and exploitation likelihood alongside CVSS, CISA's KEV catalog, and established patching SLAs.
  • Account for backported patches, configuration differences, and other security controls when validating whether a fingerprinted system is actually vulnerable.

Vendors

Anthropicup and, on some vulnerability research and exploitation tasks, surpassed what Mythos has demonstrated.  Anthropic’s September 2026 threat intelligence report shows that attackers are already doing this without accessBitsightFor Bitsight, part of the solution is using AI to accelerate product fingerprinting. Product fingerprinting means identifying the product (and where possible the version) behind an internet-facing service using the

Products

Bitsight Dynamic Vulnerability Exploit (DVE) IntelligenceCVE is actively targeted. Prioritization is crucial in this post-Mythos era. Bitsight Dynamic Vulnerability Exploit (DVE) Intelligence adds that vital layer of context by forecasting how likely a vulnerability is toBitsight GromaBitsight Groma continuously scans the public internet, picking up detailed signals about running software, open ports, misconfigurations, and vulnerabilities. This spans over 4 billion IPv4 and IPv6 addresses andCISA Known Exploited Vulnerabilities (KEV) CatalogPlease don’t take this to mean it is time to start ignoring CVSS scores, CISA's KEV catalog, or established patching SLAs; those remain essential building blocks. But DVE adds real-time context around attacker intentClaude Haikuare already doing this without access to Mythos-class models. Anthropic observed threat actors using Claude Haiku, Sonnet, and Opus to run vulnerability research and exploit development workflows in parallel. TheClaude Mythos PreviewWhile Mythos Preview isn't widely available yet, it clearly demonstrated how quickly frontier AI can bridge the gap from vulnerability discovery to working exploits. But Mythos is not the only platform capable ofCVSSPlease don’t take this to mean it is time to start ignoring CVSS scores, CISA's KEV catalog, or established patching SLAs; those remain essential building blocks. But DVE adds real-time context around attacker intent

Related Articles