UpTrajectory Review

CIO Magazine's latest piece argues that the fundamental economics of cybersecurity have shifted. For decades, defenders benefited from a simple constraint: attackers were human, and human attackers are slow. Finding a vulnerability, writing a reliable exploit, moving through a network — all of this took time and expertise. That friction gave security teams a window to detect, prioritize, and respond. The article contends that AI is collapsing that window, citing CrowdStrike's 2026 Global Threat Report, which logged an 89% year-over-year increase in attacks by AI-enabled adversaries and a 42% increase in zero-day vulnerabilities exploited before public disclosure. The piece then offers five rules CIOs should adopt, beginning with a shift from counting vulnerabilities to measuring exploitability.

For a small-business operator, this is not an abstract threat-modeling exercise. Most small businesses run lean — one IT generalist, maybe a fractional security person, and a stack of cloud services they barely have time to audit. The idea that attackers are now using AI to find and exploit weaknesses faster than a patch cycle can keep up should alarm anyone whose 'security program' consists of automatic updates and an annual pen test. The article's core insight — that discovery is becoming cheap while remediation remains expensive — hits small businesses hardest, because they have the least capacity to absorb a flood of new findings.

The genuinely useful move here is the reframing of the central question from 'How many vulnerabilities do we have?' to 'Which of these can hurt the business?' That is a real and overdue shift. Traditional CVSS severity scores have long been criticized for treating every 'critical' finding as equally urgent, which leads to alert fatigue and misallocated effort. The article is right to push exploitability — whether a weakness is actually reachable and weaponizable in your specific environment — as the prioritization criterion. Where we are somewhat skeptical is the implied urgency. CrowdStrike's numbers are striking, but the report comes from a vendor with a vested interest in amplifying threat perception. The trend is real; the exact magnitude deserves scrutiny.

The second-order effects are worth considering carefully. If AI lowers the cost of vulnerability discovery across the board, the attack surface doesn't just grow — the economics of being a small target change. Attackers who once skipped small businesses because the payoff didn't justify the effort may now find that AI makes mass exploitation cheap enough to bother. That means small businesses can no longer rely on obscurity as a de facto defense. On the remediation side, the article's logic also implies that small teams will need to get better at risk triage, not just tool deployment — a skills gap that tooling alone won't close.

What to do next: start by inventorying what you actually have exposed — not just what you think you have. If your current vulnerability scanner produces a monthly report that nobody reads, that process is now a liability, not a safeguard. Look at whether your managed service provider or security vendor has a credible answer to exploitability-based prioritization, and ask them directly how they are adapting to AI-accelerated attack timelines. And watch whether the industry converges on a shared exploitability standard — the article only previews its first rule, but the remaining four likely address response speed, identity management, and AI-specific governance, all of which deserve the same skeptical, operational read.

Takeaway: Stop counting vulnerabilities and start ranking them by exploitability — AI-driven attackers are compressing the time you have to respond.