cyber.hendryadrian.com
Security Report · securityweek.com

Rapid7 Report Warns AI Is Compressing Vulnerability Response Windows

· Original article ↗

Summary

Rapid7’s Q2 2026 analysis reports a sharp rise in high- and critical-severity vulnerability disclosures and says AI-assisted attacks are shortening response windows. It urges defenders to prioritize exposure over CVSS scores and monthly patch cycles.

Key points

  • Rapid7 reports high- and critical-severity vulnerability disclosures doubled year over year, from 4,268 in Q2 2025 to 8,539 in Q2 2026.
  • Newly exploited vulnerabilities rose 8% to 40 over the same period, according to the analysis.
  • Rapid7’s “Holy Grail” vulnerabilities—those requiring neither credentials nor user interaction—accounted for 25 of the 40 exploited vulnerabilities, up 9 percentage points year over year.
  • Rapid7 and interviewee Christiaan Beek say faster vulnerability discovery and exploitation, including AI-assisted activity, are straining traditional patch cycles.
  • Beek recommends prioritizing how exposed a system is and the impact of compromise, rather than relying on CVSS severity or a monthly patch cycle.
  • The report recorded 881 ransomware victims in the US and 91 in Germany in Q2 2026; Qilin was its most active listed group.

Article Details

Publisher
Rapid7
Report Period
Q2 2026
Scope
Vulnerability disclosure and exploitation trends, ransomware activity, and defender exposure management
Key Statistics
  • High- and critical-severity vulnerability disclosures (CVSS 7–10) doubled from 4,268 in Q2 2025 to 8,539 in Q2 2026.
  • New exploited vulnerabilities increased 8% year over year to 40 in Q2 2026.
  • In Q2 2026, 25 of the 40 exploited vulnerabilities were described as “Holy Grail” vulnerabilities; their share had increased by 9 percentage points year over year.
  • Reported ransomware victims in Q2 2026 included 881 in the US and 91 in Germany.
  • Reported ransomware targets by industry were business services (23.5%), healthcare (22.0%), manufacturing (21.0%), technology (16.9%), and construction (16.6%).
Recommendations
  • Map which areas of the network are reachable by attackers and continue reducing that exposure.
  • Prioritize vulnerability response based on network exposure and the impact of a compromised host, rather than relying primarily on CVSS severity or a monthly patch cycle.

People

Christiaan BeekRapid7’s VP of cyber intelligence; discussed the report’s findings and the need to prioritize exposure when managing vulnerabilities.

Threat Actors

AkiraIdentified in the report as one of the most active ransomware groups.DragonForceIdentified in the report as one of the most active ransomware groups.LockBitIdentified in the report as one of the most active ransomware groups.QilinIdentified in the report as one of the most active ransomware groups.The GentlemenIdentified in the report as one of the most active ransomware groups.

Vendors

Rapid7Recent analysis from Rapid7 demonstrates the fallacy of defenders continuing to rely on patching their way out of problems.

Countries

ChinaPersistent nation-state activity from the cybersecurity axis of evil (China, Russia, Iran and North Korea, often known as CRINK) is also highlighted in the report.GermanyGermany comes second; but the numerical difference is stark.IranPersistent nation-state activity from the cybersecurity axis of evil (China, Russia, Iran and North Korea, often known as CRINK) is also highlighted in the report.North KoreaPersistent nation-state activity from the cybersecurity axis of evil (China, Russia, Iran and North Korea, often known as CRINK) is also highlighted in the report.RussiaPersistent nation-state activity from the cybersecurity axis of evil (China, Russia, Iran and North Korea, often known as CRINK) is also highlighted in the report.TaiwanRussia is active primarily in Ukraine and against Ukraine’s supporters; Iran is targeting the US and US allies; China is active against Taiwan; and North Korea targets anything it thinks it can monetize.UkraineRussia is active primarily in Ukraine and against Ukraine’s supporters; Iran is targeting the US and US allies; China is active against Taiwan; and North Korea targets anything it thinks it can monetize.United StatesRussia is active primarily in Ukraine and against Ukraine’s supporters; Iran is targeting the US and US allies; China is active against Taiwan; and North Korea targets anything it thinks it can monetize.

Industries

business servicesDragonForce, Akira and LockBit were, in that order, the most active ransomware groups; and business services (23.5%), healthcare (22.0%), manufacturing (21.0%), technology (16.9%), and construction (16.6%)Constructionand business services (23.5%), healthcare (22.0%), manufacturing (21.0%), technology (16.9%), and construction (16.6%) were the targets.Healthcareand LockBit were, in that order, the most active ransomware groups; and business services (23.5%), healthcare (22.0%), manufacturing (21.0%), technology (16.9%), and construction (16.6%) were the targets.Manufacturingin that order, the most active ransomware groups; and business services (23.5%), healthcare (22.0%), manufacturing (21.0%), technology (16.9%), and construction (16.6%) were the targets.Technologyactive ransomware groups; and business services (23.5%), healthcare (22.0%), manufacturing (21.0%), technology (16.9%), and construction (16.6%) were the targets.

Related Articles