SentinelOne , the AI security leader, and Tenable Holdings, Inc. , the exposure management company, today released joint research that suggests a growing disconnect between vulnerability discovery, disclosure and actual exploitation. The research draws on Tenable's exposure data across thousands of organizations and remediation telemetry with SentinelOne's endpoint and post-exploitation detection data.
Together, both views produce a prioritized picture of where risk is concentrating, with lessons ripe for the Frontier AI era. The most critical takeaway is that both nation state and criminal threat actors are focusing on vendors and susceptible points in the attack surface more than specific CVEs.
Current attacker timelines are already moving faster than standard patch cycles can address. New frontier AI models compress vulnerability discovery from months to hours, significantly expanding potential risks while speeding time from disclosure to exploit code to about a week. Today, the median organization takes five months to remediate known vulnerabilities. Closing that window takes more than speed, it takes knowing which product lines are more likely to carry the next wave of exploitation.
The research finds that exposure data and runtime detection converge on the same edge-device vendor surfaces 79% of the time, while they share only 21% overlap at the individual vulnerability level. Both state-sponsored actors and ransomware operators draw from the same small set of high-severity, actively exploited vulnerabilities. The surfaces are consistent and the actors are not.
More than half of organizations running F5 products carry at least one exposed, actively exploited vulnerability, while Citrix customers post the slowest remediation of any vendor studied at a median of 461 days — illustrating how specific product lines stay exposed long after a patch exists. Remediation complexity on high-priority vulnerabilities introduces a statistically significant 24-day gap.
Twelve vulnerabilities in the dataset carry confirmed multi-nexus attribution — state-sponsored and ransomware operators independently exploiting the very same flaw across five distinct threat categories.
"Speed alone is not enough. By the time a vulnerability hits a remediation queue, adversaries are already iterating the exploit," said Steve Stone, Chief Customer Officer at SentinelOne. "Static signatures run on human timelines, the threat does not. Runtime behavioral detection has to match that cadence, flagging exploitation patterns as they emerge rather than after the fact."
For security teams, the research reinforces the need to look beyond individual vulnerabilities and understand which technology surfaces attackers repeatedly target. Tenable's exposure data shows where organizations are most exposed and where risk is concentrated, while SentinelOne's runtime threat and DFIR data shows where and how attackers are operating in the wild.
"Attackers systematically target specific vendor ecosystems that could provide access. They aren't obsessing over single vulnerabilities, and neither should defenders," said Vlad Korsunsky, Chief Technology Officer, Tenable. "Our joint research confirms that attackers, big and small, target the same attack surfaces the majority of the time. This research underscores exposure management principles: seeing, prioritizing and fixing exposures that create real business risk. As attackers weaponize AI to breach defenses faster, organizations that embrace exposure management will win."
The research is the latest collaboration in an expanding partnership, building on SentinelOne's participation as a founding member of Tenable's CyberAgents Exchange announced at Black Hat USA 2026.
About SentinelOne
SentinelOne is the leader in AI security, setting the standard for using AI and automation to give defenders a decisive operating advantage. Built for those who secure our world, its platform delivers unified coverage across endpoints, identity, cloud, and AI. Powered by Autonomous Security Intelligence, SentinelOne stops attacks at machine speed, reducing risk and delivering clarity and control to stay one step ahead. Headquartered in Mountain View, California with teams worldwide, SentinelOne protects nearly one-fifth of the Fortune 500 and hundreds of Global 2000 enterprises. From Main Street to Wall Street, the world's most critical organizations trust SentinelOne with their security.
About Tenable
Tenable® is the exposure management company, exposing and closing the cybersecurity gaps that erode business value, reputation and trust. The company’s AI-powered exposure management platform radically unifies security visibility, insight and action across the attack surface, equipping modern organizations to protect against attacks from IT infrastructure to cloud environments to critical infrastructure and everywhere in between. By protecting enterprises from security exposure, Tenable reduces business risk for over 40,000 customers around the globe.
