Proactive Threat Hunting: How Agentic AI Tracks CVEs

Reading time: 6 min

An owl doesn't just wait for prey to come near. It patrols its territory in the dark, catches the slightest movement, and strikes before its target even realizes it's been spotted.

That's exactly the logic behind proactive threat hunting: instead of waiting for an alert to trigger on your own infrastructure, you go looking for the threat where it first appears, before it ever reaches you.

That's the principle behind our proactive threat hunting engine, built by Patrowl's R&D and CTI team: an agentic AI that applies this active watch, 24/7, across every vulnerability published worldwide.

Key takeaways

• Proactive threat hunting means going after the threat before it reaches your infrastructure, rather than waiting for an alert.

• Our agentic AI continuously monitors 38 sources of vulnerability information, without waiting for a scheduled scan cycle.

• Every vulnerability is ranked by the real risk it represents, then verified with concrete proof, not just a guess.

• Every result is validated by a pentester (an expert who tests security the way a real attacker would) before it reaches you.

• Average detection time observed across 100 analyzed CVEs: under 4 hours, across all scenarios.

A CVE (Common Vulnerabilities and Exposures) is the standard identifier used worldwide to designate a known, documented security flaw. The context in which it circulates has changed dramatically in just a few years.

The time between a CVE's public disclosure and its first mass exploitation rarely exceeds a few hours today, whereas it was still several months five years ago: this average window dropped from 745 days in 2020 to 44 days in 2025 (source: Flashpoint, time-to-exploit trends).

The time between a vulnerability's publication and its addition to the CISA KEV catalog (the list maintained by the US cybersecurity agency, tracking flaws actively exploited in the real world) dropped to 5 days in 2026, as attackers automate their monitoring and pounce on the latest flaws the moment they're published (source: Rapid7, 2026 Global Threat Landscape Report, cited by Infosecurity Magazine).

For a security team, keeping this pace by hand is no longer possible, especially since CVE submissions grew 263% between 2020 and 2025, without the volume processed each year managing to absorb the incoming flow (source: NIST, update on CVE processing, April 2026). This is exactly the definition of proactive threat hunting: going after the threat before it touches you, rather than waiting for it to show up on your infrastructure.

Our proactive threat hunting engine applies this logic 24/7, across every published vulnerability, listening to threat intelligence feeds (the sum of public information on ongoing threats) from CERTs and vendor advisories the moment they're published. It also monitors a portfolio of strategic GitHub repositories to catch silent fixes — flaws that a vendor quietly patches without ever publishing a CVE. This means you're covered against threats the rest of the market doesn't see yet, sometimes before a CVE even exists.

A traditional security tool typically checks your exposure on a scan cycle — at regular intervals, weekly or monthly, for example — whereas our engine works differently: it's alerted the moment a source publishes information, and analyzes it immediately, without waiting for the next cycle.

It continuously monitors 38 sources: NVD and CISA KEV (the reference US databases), EPSS (a score that estimates the probability a flaw will be exploited), CERT-FR and equivalent CERTs abroad, vendor security bulletins, GitHub publications, as well as specialized cybersecurity press.

Hundreds of vulnerabilities are published worldwide every day, but they don't all pose the same danger to you.

For every vulnerability it spots, our agentic AI runs a full investigation before deciding whether it deserves your attention, based on explicit, verifiable criteria:

• The technical severity of the flaw: can it allow an attacker to take remote control, bypass a password, or access data? A score called CVSS gives a first benchmark, but it's never used alone.

• The real probability of exploitation, measured by the EPSS score, and whether the flaw appears in the CISA KEV catalog.

• The existence of public attack code, also called an exploit or proof-of-concept: a technical demonstration proving the flaw can be exploited.

• Whether the affected technology is accessible from the internet, rather than on a protected internal network.

• The level of access required to exploit the flaw. Our engine prioritizes so-called black-box scenarios, where the attacker needs no password or prior access.

A severe flaw, with public attack code and accessible from the internet, rises to the top of the list. A moderate flaw, never exploited and hidden behind internal authentication, gets set aside.

Spotting the threat isn't enough. Our agentic AI first produces a passive detection — a check that doesn't interact with your systems and simply confirms that the affected software version is present on your exposed surface — before going further when the stakes justify it: it then generates an exploit, real attack code, which a specialist runs in a controlled setting with no risk to your systems, to confirm the flaw is genuinely exploitable in your environment.

Before any result reaches you, a Patrowl pentester reviews the analysis, confirms the proof, and eliminates every false positive. No component ever validates its own results: our agentic AI detects and proposes, the pentester verifies and validates.

Qualified, validated threats surface in your dashboard as Trending Attacks: a clear, already-prioritized alert, with all the context you need to act.

Each CVE is then verified against your own assets — your actual software and servers: if no reliable attack code exists yet, our engine simply confirms whether the affected version is present in your environment, while if working attack code exists, it actively tests it, in a controlled setting, to verify it genuinely works on your systems. This way you know whether the flaw really affects you, within hours rather than finding out too late.

The figures below are measured over the last three months, on a sample of 100 analyzed CVEs. These aren't contractual commitments, but a realistic snapshot of our usual speed.

Three stages are measured: the alert, contextualized detection (confirming the affected version is present in your environment), and effective exploitation (proof that the attack genuinely works on your assets).

These times are expressed in hours and business days. Actual speed depends on factors we don't always control, such as the vendor's behavior or the stability of your own systems. We always favor a safe approach over speed at all costs.

A traditional vulnerability scanner tells you what's present on your infrastructure. Our agentic AI tells you what's genuinely exploitable today, by an external attacker with no prior access.

Our agentic AI only alerts you on genuinely dangerous flaws, with proof the attack works on your assets. That's the difference between raw information and ready-to-act intelligence.

Want to see what our proactive threat hunting engine would detect on your own exposed surface? Discover our CVE management module, powered by agentic AI.