A security team can have a current vulnerability report and still not know which systems an attacker can reach.

The difference became clear in today's AFCEA Find, Fix, Verify webinar. The published presenter roster lists Kenneth Bible, John Gilligan, David Mayer and Sam Vazquez, with Nuray Taylor as moderator, for a discussion of asset discovery, attack paths and remediation. One recurring concern was straightforward: organizations cannot evaluate exposures they have not identified. This account draws on a partial attendee transcript, not an independently verified recording of individual remarks.

The inventory problem

Traditional vulnerability management often starts with a known asset list. That is useful, until the list stops reflecting the environment. A new service can go live outside the normal process. An old DNS record can point toward forgotten infrastructure. Separate teams can operate systems without a shared view of ownership or configuration.

The problem is larger than scan frequency. If an internet-facing asset is missing from inventory, its software version, exposure and remediation status may also be missing.

CISA's Binding Operational Directive 23-01 requires covered federal civilian agencies to perform automated discovery of in-scope assets every seven days and initiate vulnerability enumeration every 14 days. The requirement is specific to those federal systems, but the underlying discipline applies more broadly: before prioritizing vulnerabilities, establish what is actually deployed.

Findings versus actual exposure

A severity score describes a vulnerability, not the whole operating environment. Reachability, exposed privileges, neighboring systems and functioning controls change the consequences of a finding. Two identical software defects can present different organizational risks.

The panel emphasized that vulnerabilities can be chained into paths toward a particular objective. AI can help examine large inventories and propose those paths, but participants also acknowledged mistaken or hallucinated steps. An AI-generated route is a hypothesis until someone tests it under defined conditions.

NIST's June 17 update to the National Vulnerability Database introduced Stakeholder-Specific Vulnerability Categorization (SSVC) and affected-product information alongside existing CVSS scores. That distinction is useful: assigning technical severity and deciding which exposure to address first are different judgments.

What the OT and PHP examples demonstrate

The webinar referenced Booz Allen Hamilton's controlled operational technology tests. In one scenario, models progressed from a perimeter compromise to actions inside an industrial control network in just over 16 minutes. In a separate scenario, a model identified and moved a robotic arm within minutes. Across eight laboratory scenarios, the defined objectives were achieved, with human approval of exploits and physical effects. These were not uncontrolled attacks on operating facilities. Some defenses blocked individual actions, which matters as much as the successful paths.

Today's PHP disclosure shows the same issue at internet scale. The PHP security team released updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both capable of permitting unauthenticated remote code execution under affected conditions.

OpenAI says Calif identified a critical flaw with GPT-5.6 Sol; Wiz independently found and reported both vulnerabilities and demonstrated exploit paths in selected deployments. AI helped researchers discover flaws and develop working methods. It did not make the underlying code vulnerable, and PHP maintainers led the fixes.

Now consider the defender. Can it identify every internet-facing PHP instance, the installed version and the hosting configuration? Does it know which systems received the fix? Cloudflare reports deploying protections and observing attack traffic. A web application firewall may reduce exposure, but PHP says updating is the only complete solution. Neither an advisory nor a firewall rule proves that an individual deployment is safe.

What verified remediation requires

Finding the flaw, changing the software and demonstrating reduced risk are three different outcomes.

A defensible process records the affected asset and configuration, the reachable attack path, the authorized correction and the exact version deployed. It repeats the relevant negative test after remediation and preserves enough evidence for a reviewer to understand what was actually tested. It also records what remains unknown.

That evidence has limits. Blocking one demonstrated path does not prove every possible route is closed. But it establishes something more useful than a closed ticket: under specified conditions, the previously demonstrated behavior no longer succeeds.

As AI speeds vulnerability research, organizations need more than faster scanning. They need better inventories, evidence about reachable consequences, and repeatable proof that remediation changed the result.

The important measure is not how many weaknesses were found. It is what an attacker can still reach after the fix.

Sources

  1. AFCEA International, Find, Fix, Verify webinar listing. October 21, 2026. Panel observations from an attendee-supplied partial transcript, not attributed verbatim.
  2. CISA, Binding Operational Directive 23-01. Federal asset visibility and vulnerability enumeration.
  3. NIST, National Vulnerability Database. June 17, 2026, SSVC and affected-product data update.
  4. Booz Allen Hamilton, OT laboratory testing. Eight bounded laboratory scenarios.
  5. PHP security advisory. October 21, 2026.
  6. OpenAI, coordinated PHP disclosure and Wiz, PHP2Shell technical research. Research and attribution.
  7. Cloudflare, PHP2Shell mitigations. WAF response and attack observations.