Joint research finds that runtime exposure and detection data converge on the same vendor surfaces, even as vulnerabilities change
SentinelOne (NYSE: S), a leader in AI-powered cybersecurity and Tenable® Holdings, Inc. (NASDAQ: TENB), a risk exposure management company, released joint research highlighting a growing gap between vulnerability identification, disclosure and effective exploitation. The research is based on vulnerability data collected by Tenable from thousands of organizations and remediation telemetry data, integrated with SentinelOne data on endpoint detection and post-exploitation activity. Together, these two sources provide a hierarchical picture of the areas where risks are concentrated, with valuable insights for the era of advanced AI. Most significantly, both nation-state and criminal organization attacks focus on vendors and potential attack surface weaknesses rather than specific CVE vulnerabilities.
Current attack dynamics are evolving at a faster pace than standard patch cycles can handle. Advanced AI models reduce vulnerability discovery times from months to hours, exposing systems to potentially higher risks and allowing hackers to go from discovery to creation of exploit code in about a week. Today, it takes the average organization five months to fix known vulnerabilities₁. To fill this gap, speed is not enough: we need to know which product lines are most exposed to the next wave of attacks.
The research finds that exposure data and runtime detection converge on the same edge device vendors 79% of the time, while at the individual vulnerability level there is only 21% overlap. Both nation-state and ransomware authors draw from the same small set of actively exploited high-priority vulnerabilities. Surfaces are constant, while authors are not. This distinction is key to establishing defense priorities; a model that Tenable has called “Persistently Targeted Vendor”. The idea is that it is a small set of products from a vendor, and not individual CVEs, that pose the long-term risk.
Among the key findings that emerged from the research are:
- Twelve vulnerabilities in the dataset have a confirmed “multi-nexus” attribution: State-sponsored operators and ransomware attackers independently exploit the same vulnerability across five distinct threat categories, including China, Russia, North Korea, Iran, and criminal (financially motivated) actors.
- More than half (54%) of organizations using F5 products have at least one exposed and actively exploited vulnerability, while Citrix customers have the slowest remediation times of all vendors surveyed, averaging 461 days — a concrete example of how specific product lines remain exposed long after a patch is available.
- The complexity of remediating high-priority vulnerabilities introduces a statistically significant 24-day gap, widening the window of time for hackers to execute an exploit — underscoring why patching speed alone isn't sufficient without attack surface reduction and endpoint protection working together.
"Speed alone is not enough. By the time a vulnerability enters the remediation process, hackers are already perfecting the exploit," said Steve Stone, Chief Customer Officer at SentinelOne. "Static signatures pace humans, but threats do not. Runtime behavioral detection must match that pace, flagging patterns of exploitation not after the fact, but as they emerge."
For security teams, the research highlights the need to look beyond individual vulnerabilities and understand which digital surfaces are repeatedly targeted. Tenable exposure data shows where organizations are most vulnerable and where risk is concentrated, while SentinelOne runtime threat and digital forensics and incident response (DFIR) data shows where and how attackers operate in a real-world environment. The convergence of these two distinct perspectives provides security managers with stronger evidence to prioritize remediation, enhance detection, and reduce risk on constantly targeted digital surfaces.
"Attackers systematically target specific vendor ecosystems that could provide them with an entry point. They don't obsessively focus on individual vulnerabilities, and neither should defenders," said Vlad Korsunsky, Chief Technology Officer at Tenable. "The joint research confirms that attackers, large and small, target the same attack surfaces in most cases. The research highlights the principles of exposure management: identifying, prioritizing and remediating exposures that create real risk to the enterprise. As attackers use AI to breach defenses more quickly, organizations that adopt exposure management will prevail."
The research is the latest collaboration in an ever-expanding partnership between best-in-class companies specializing in AI-native CTEM technologies and AI-based real-time detection and response solutions, building on the work already done jointly by Tenable and SentinelOne, including SentinelOne's participation as a founding member of the CyberAgents Exchange by Tenable, announced during Black Hat USA 2026. This is the latest step in a partnership that continues to refine thanks to both companies' growing investments in AI-based security. The complete research is available at sentinelone.com e tenable.com.
