Beazley Reports AI-Driven Surge in Vulnerability Disclosures

The report did not identify a comparable shift in the basic methods used to enter victim environments. According to Beazley Security's ransomware investigations, compromised credentials used against internet-facing VPN and remote desktop services accounted for 67% of intrusions, down from 74% in Q1 but still the dominant initial-access route.

CIR Magazine also reported that business email compromise remained common. Attackers were increasingly abusing Microsoft's device-code authentication flow to obtain session tokens, according to Beazley. In that technique, a victim completes a legitimate sign-in and satisfies multifactor authentication, removing the need for an attacker to intercept an authentication code.

Public ransomware leak-site postings fell slightly to 2,268, but remained nearly 60% above the Q2 2025 level, CIR Magazine reported. The same coverage noted that StealC operators released a new version within four days of an Operation ENDGAME takedown and offered the earlier source code for $60,000.

For vulnerability-management teams, the most important distinction is between disclosure volume and demonstrated exploitation. CISA's KEV catalog is one established signal for prioritizing patching work because it tracks vulnerabilities confirmed as exploited in the wild. It is not a complete measure of attacker activity, but the reported 36% versus 10% divergence illustrates why raw CVE intake can become a less useful proxy for urgent operational risk.

Across comparable periods of higher disclosure volume, security teams commonly rely more heavily on asset inventory, internet exposure, exploit evidence, compensating controls, and business criticality rather than severity scores alone. The Beazley findings place that longstanding triage practice in a setting where AI-assisted research can increase the volume of findings entering public disclosure channels without necessarily changing the most common initial-access techniques.