Forescout Report: AI and Supply Chain Attacks Drive 51% Surge in Vulnerabilities

The cybersecurity landscape has witnessed a dramatic escalation in threats during the first half of 2026, as detailed in Forescout's recent 2026H1 Threat Review. The report highlights a concerning 51% increase in published vulnerabilities compared to the previous period, translating to an average of 205 new Common Vulnerabilities and Exposures (CVEs) disclosed daily. This unprecedented volume is largely driven by the accelerating capabilities of AI in vulnerability discovery and the continued evolution of software supply chain attacks. More than half (55%) of these newly disclosed vulnerabilities were rated as high or critical in severity, with 54 identified as zero-days. Furthermore, the Cybersecurity and Infrastructure Security Agency (CISA) added 146 CVEs to its Known Exploited Vulnerabilities (KEV) catalog, an 11% increase, underscoring the active exploitation of these flaws. This isn't merely an academic statistic; it represents a profound operational crisis for application security (AppSec) teams. The sheer volume of new vulnerabilities, coupled with their increasing severity and exploitability, renders traditional, reactive vulnerability management approaches ineffective. Security teams are already struggling with extensive backlogs, and this surge threatens to overwhelm them entirely. The direct implication is that organizations are facing a significantly expanded attack surface, making it harder than ever to identify and remediate the most critical risks before they are exploited. The report explicitly links this acceleration to AI, which is now both a tool for finding vulnerabilities and a target for exploitation. The trend of escalating vulnerabilities has been ongoing, but the advent of sophisticated AI models has fundamentally reshaped its trajectory. Frontier AI models, such as Anthropic's Mythos and GPT-5.5-Cyber, are demonstrating an unprecedented ability to discover vulnerabilities at scale, identifying thousands of potential flaws across open-source projects. This capability, while potentially beneficial for defenders, is also being leveraged by threat actors, creating a rapid feedback loop where discovery quickly leads to exploitation. Simultaneously, software supply chain attacks have grown in complexity and frequency. Recent incidents, such as those involving TeamPCP and PCPJack compromising trusted CI/CD pipelines and security scanners, illustrate how attackers are now targeting the very mechanisms designed to ensure software integrity. This dual pressure from AI-accelerated discovery and advanced supply chain infiltration creates a challenging environment where traditional trust signals can be bypassed. For practitioners, the Forescout report signals an urgent need to pivot from conventional vulnerability management to a more proactive, risk-based exposure management strategy. This means prioritizing vulnerabilities not just by their CVSS score, but by their actual exploitability, business impact, and whether they form part of a realistic attack path within the organization's unique environment. Investing in advanced security tools that can leverage AI for intelligent prioritization and contextual analysis is becoming imperative, though practitioners must also remain aware of the limitations and potential false positives associated with LLM-based analysis. Furthermore, a renewed focus on the integrity of the entire software supply chain is critical. This includes implementing robust behavioral analysis, beyond static trust signals, to detect compromises within trusted build and deployment processes. Organizations must also recognize that AI itself is now a significant attack vector, requiring dedicated security measures for AI applications and models. The emphasis must shift from simply counting vulnerabilities to effectively managing and reducing the organization's overall cyber exposure.