A recent analysis by Tenable identified 457 million AI-related security issues across more than 7,000 organizations over a 30-day period, averaging 62,000 exposures per organization. These issues are primarily linked to misconfigurations and unmanaged dependencies within AI tools, rather than traditional Common Vulnerabilities and Exposures (CVEs). The findings highlight a significant challenge posed by the widespread adoption of both approved and unapproved AI applications, often referred to as "shadow AI."
The cybersecurity firm emphasizes that focusing solely on CVEs and patching schedules is no longer sufficient for managing cyber risk, particularly as AI accelerates threat discovery and exploitation. While vulnerability exploitation remains a common initial access vector, accounting for 31% of breaches according to the 2026 Verizon Data Breach Investigations Report (DBIR), a substantial portion of incidents originate from non-CVE issues.
Tenable's telemetry indicates that approximately 37% of security findings are not CVEs, yet these account for 63% of breach entry points. These non-CVE threats include misconfigurations, stolen credentials, and exposed secrets. The proliferation of AI tools further exacerbates this visibility gap, as many AI-related risks stem from Large Language Model (LLM) misconfigurations, unmanaged model dependencies, and exposed credentials within AI workloads.
One specific example cited involved a customer discovering 12 instances of OpenClaw, an agentic AI personal assistant tool, running in their cloud environment without approval. Further investigation revealed that a contractor had installed these instances, granting them access to API keys and a significant portion of the customer's source code. The contractor had also configured OpenClaw for remote management via Telegram, an unapproved communication channel, allowing the tool to download unknown software from the internet without the company's visibility or control.
The analysis also highlighted persistent issues with vulnerability remediation. Despite the availability of patches, many organizations remain exposed to long-standing vulnerabilities. For instance, Tenable found 1,865 organizations still vulnerable to CVE-2024-21762 in Fortinet FortiOS, 3,569 to the 2021 Log4Shell vulnerability (CVE-2021-44228), and 1,430 to the 2017 WannaCry vulnerability (CVE-2017-0144).
Furthermore, the 2026 Verizon DBIR reported that organizations fully remediated only 26% of CVEs listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. The median time-to-patch has increased to 43 days, up from 32 days in the previous year, indicating a decline in timely patching efforts even as AI enables attackers to exploit flaws more rapidly.
To address these evolving threats, security teams are encouraged to adopt AI-driven exposure management strategies. This approach moves beyond traditional vulnerability scanning to continuously assess vulnerabilities, misconfigurations, excessive permissions, and exposed secrets across an organization's entire attack surface, including on-premises, cloud, operational technology (OT), and AI environments. Crucially, exposure management aims to map the attack paths that connect these various security findings, as Tenable's research suggests an average of three attack paths for every single security finding.
