The rapid acceleration of vulnerability discovery, particularly through AI-powered tools, is outpacing the ability of organizations to patch them, creating a critical need to prioritize remediation efforts based on actual exploitability rather than theoretical severity. This challenge is being addressed by the Athena coalition, an industry initiative launched by Chainguard to coordinate defenses for open-source software. Qualys, a cybersecurity solutions provider, has joined this coalition, bringing its expertise in validating whether vulnerabilities can be exploited in real-world environments.
The volume of identified vulnerabilities has become a velocity problem, with AI models discovering novel flaws in open-source software at an unprecedented speed. In its initial weeks, the Athena project processed tens of thousands of findings, with a significant portion categorized as critical or high severity. However, the true exposure can be even greater, as AI can chain together lower-severity vulnerabilities to achieve critical outcomes like unauthenticated remote code execution, which might not be apparent from individual CVSS scores.
Research indicates that vulnerabilities are often weaponized before patches are even available, with mean time-to-exploit sometimes being negative. Data from over 10,000 organizations shows a substantial increase in closed vulnerability events between 2022 and 2025, yet the proportion of critical vulnerabilities remaining open after seven days has also risen. This suggests that simply discovering more vulnerabilities, without a corresponding improvement in remediation effectiveness, leads to an accelerating backlog.
A key issue highlighted is the discrepancy between vulnerability severity and actual exploitability. Less than one percent of vulnerabilities labeled as critical are ever exploited in the wild. Many remediation queues are filled with theoretical issues flagged by scanners based on version matches with CVEs, without considering factors like code path reachability, service exposure, or existing protective controls. This leads to wasted engineering resources on non-exploitable flaws while genuinely dangerous ones languish.
Furthermore, a growing number of real-world exposures lack a CVE identifier, making them invisible to traditional scanning tools. Some findings within Athena relate to packages that are over five years old, where vulnerabilities may have been silently fixed upstream without any formal record. Attackers do not rely on CVEs, and defenders are increasingly finding themselves at a disadvantage by depending solely on them.
Qualys aims to bridge this gap by providing validated exploitability information. Their TruConfirm technology is designed to confirm whether a vulnerability is actively exploitable on a specific asset. This is achieved through safe, non-destructive validation methods that mimic attacker techniques without deploying malicious payloads. Examples include triggering benign callbacks or obtaining read-only response signatures that confirm code execution.
The goal of this validation process is to provide concrete proof of exploitability, enabling remediation teams to act with confidence and auditors to verify actions. This transforms raw vulnerability intelligence into actionable decisions tailored to an organization's specific environment. When Athena identifies a vulnerability under embargo, Qualys can provide customers with confirmed information about its exploitability within their systems, along with details on existing compensating controls.
Validation does not replace patching but rather informs and prioritizes it. In scenarios where time-to-exploit is extremely short and patch deployment takes weeks, knowing precisely which exposures are live is crucial. This allows organizations to implement interim controls, schedule patching based on business needs, and subsequently verify that the vulnerability has been successfully closed.
The Athena coalition, with its focus on accelerating the discovery and fixing of open-source software vulnerabilities, and Qualys, with its capability to validate exploitability and provide environmental context, represent a coordinated approach to modern cybersecurity challenges. This partnership aims to move beyond simply receiving alerts to making informed, validated decisions that reduce actual risk before attackers can exploit them.
