Recorded Future's half-year data shows adversaries continuing to favor abusing legitimate tools and trusted platforms already inside the enterprise

Do the arithmetic on the reachability figures and the prioritisation argument makes itself. Sixty of the 215 actively exploited CVEs were network-reachable, required no credentials and ended in code execution ^[3][1], which is 28 percent of the exploited set ^[14]. Of the 146 that needed no prior authentication, 142 were also network-accessible ^[2], or 97 percent ^[15]. Pre-auth and remote is not the exception in this data set; it is the shape of most of it.

That ratio is what a patch queue runs on. Insikt Group's own framing is that exposure and impact say more about operational risk than vendor ranking or severity score alone, because campaign reporting showed the same post-exploitation playbooks reused against newly disclosed and long-standing vulnerabilities ^[4][13]. Same playbook, different entry point.

The evasion claim is a separate argument resting on softer evidence. Recorded Future describes actors leaning on exposed software, developer tools, remote access utilities, payment workflows and third-party services, and on familiar execution, obfuscation, discovery and payload-transfer techniques rather than new ones ^[18][7]. Two of the named cases show what that costs a detection team. Mobile malware abused NFC to commit payment fraud, and Magecart operators worked through trusted third-party services and checkout manipulation ^[9]. In both, the thing to catch is a sequence inside a payment path, which is why the report pushes detection toward suspicious sequences of behaviour rather than isolated events ^[12].

AI is the part most likely to be over-read. Recorded Future places observed AI-enabled malware capability at levels 1 to 3 of its AIM3 model, with AI handling discrete functions such as persistence, UI interaction, malware development and delivery rather than autonomous operations ^[10]. The budget consequence sits on the vulnerability side instead, where AI-assisted research has already increased the volume of vulnerability reports and could compress remediation timelines further by accelerating exploit-path analysis and lowering exploit-development costs for skilled operators ^[11].

One caveat on the headline count. The 215 figure is what one vendor's analysts tracked as actively exploited, so the year-on-year increase of 54 CVEs ^[16] measures Insikt Group's coverage as well as attacker behaviour. The rate it implies, roughly 1.2 newly exploited CVEs per day across the half ^[17], is the arrival load a triage rota has to absorb, and the reason the ordering rule matters more than the total.