cKEV Index Launches to Prioritize Vulnerabilities as AI Accelerates Exploit Development

CyberOK has launched the cKEV Index, an open catalog of prioritized vulnerabilities based on the Urgent Patch Score (UPS) methodology. The index aims to help security teams decide which issues to address first as AI tools speed up vulnerability discovery and exploit creation while patch deployment timelines remain unchanged.

AI assistance now allows attackers to analyze unfamiliar applications, refine existing exploits, and scan more systems faster. Anthropic documented two campaigns, GTG-50014 and GTG-50029, where threat actors used AI agents for reconnaissance, code analysis, credential extraction from Android apps, and exploit development that succeeded against at least four websites. These cases show how small teams or even single operators can now perform work previously requiring larger groups.

The same AI capabilities benefit defenders. CyberOK researchers developed the open rust-in-peace framework that combines multiple AI-driven techniques for vulnerability discovery, hypothesis testing, exploit reproduction, and patch verification. The project has already reported nearly one hundred findings to open-source maintainers, including the Linux kernel.

Vendors are also feeling the impact. Microsoft delayed the first cumulative update for Exchange Server Subscription Edition because AI increased the volume of findings that required validation, reproduction, and regression testing. Oracle issued its largest-ever Critical Patch Update covering 1434 CVEs, citing expanded product coverage and AI-assisted detection among the reasons.

The UPS methodology tracks verifiable signals such as publication dates, exploit tool releases, and confirmed attacks. Each vulnerability moves through defined phases: Radar, Watch, Track, Prepare, Urgent Patch, and Emergency / IR. Strong signals can immediately elevate priority without requiring every stage to be completed sequentially.

The open cKEV Index currently displays only the two most urgent phases along with abbreviated event histories, CVSS and EPSS scores, exploitation details, and remediation guidance. Organizations are advised to start with products actually present in their environment, verify affected systems, assign owners, and set deadlines rather than attempting to process the entire catalog at once.