VulnCheck
A US security intelligence firm that tracks which software vulnerabilities are genuinely being exploited in the wild.
VulnCheck makes its name on a distinction that matters more than it sounds: the difference between a vulnerability that exists and one that is actually being attacked. Tens of thousands of flaws get published every year, and only a small fraction ever get used against anyone. VulnCheck maintains data on which ones cross that line and how quickly, which is what lets defenders prioritise instead of drowning.
Its half-year reports have become a common reference point in arguments about AI and security, because they supply numbers where most of the debate supplies adjectives. The 2026 edition found that flaws discovered with AI help were exploited at roughly the same low rate as everything else, while the time from public disclosure to first real attack kept shrinking.