A few years ago, I wrote a few research papers using cve generation rate by functional area to estimate a kind of "mean time to novel hack" across an attack graph for a given architecture. It used the relative consistency of cve generation as a reasonable baseline to project "how long until the next set of zero days that actually impacts your system."
AI doesn't break that model, but it certainly turns all the estimated times from months or days into basically minutes.
AI doesn't break that model, but it certainly turns all the estimated times from months or days into basically minutes.