The number of disclosed vulnerabilities continues to rise, yet only a small fraction are actually exploited by attackers. According to Google Threat Intelligence Group (GTIC), the number of vulnerabilities disclosed each month in 2026 increased from 5,045 in January to 10,740 in August—more than doubling—while only 0.23% were actually exploited.[1]

Compounding the challenge, security teams have less time to respond once vulnerabilities become public. According to VulnCheck, the median time from vulnerability disclosure to confirmed exploitation fell from 120 days in 2025 to 80 days in the first half of 2026—a reduction of nearly one-third.[2]  With more vulnerabilities and less time to respond, simply identifying vulnerabilities is no longer enough. Security teams need to determine more quickly which risks require attention first.

That decision cannot be made based on vulnerability volume or severity alone. These factors can indicate system weaknesses and potential impact, but they do not show whether attackers are actively exploiting a vulnerability, how they are exploiting it, or what traces they may leave behind. As vulnerability lists continue to grow, information from real-world attack activity becomes an important basis for security teams to prioritize risk and plan their next response.

Bringing Attacker Research into Vulnerability Risk Assessment

TeamT5 has long tracked the behavior and attack activity of hacker groups across the Asia-Pacific region, studying how vulnerabilities are exploited in real-world attacks and what traces attackers leave behind. These research findings are then translated into detection capabilities that can be applied in practice, helping security teams incorporate clues from hacker activity when assessing vulnerability risk:

  • Real-world exploitation
    Understand which vulnerabilities have already appeared in real-world attacks and identify which risks warrant greater attention.

  • Possible signs of compromise
    Use detected technical indicators to identify signs that may suggest a vulnerability has been exploited or that a system may have been accessed without authorization.

  • Direction for response
    Combine technical evidence with risk information to help teams determine whether remediation should be prioritized or whether further verification and investigation are needed.

Vulnerability priority should not be determined by a vulnerability’s risk level alone. Teams also need to consider whether it has already been exploited in real-world attacks and whether there are signs that an attacker has left behind. Only by looking at vulnerability risk from the attacker’s perspective can security teams truly understand the real-world risks most relevant to their organization.

References:

[1] Google Threat Intelligence Group, Vulnerability Discovery and Exploitation Trends in the AI Era, October 2026

[2] VulnCheck, VulnCheck State of Exploitation 1H-2026, July 2026