We Ignored the Edge for 20 Years. AI Just Made That Untenable.

Across the many external offensive engagements my team has run over the last decade: pen tests, full-scope red teams, you name it, we got in often. Walked the org to total compromise. Nobody noticed.

Not the SOC, not the MDR provider, not the endpoint stack. The few times someone did spot us, they couldn't stop us anyway.

None of this involved phishing. No clicked links, no social engineering. Just credentials/tokens sitting on the open internet, a vulnerable web app, a forgotten subdomain. Stuff that had been sitting out there for months before we showed up.

The team building Divert has spent careers on the offensive side. We know how this gets played. And what comes next is a hypothesis I want to ground in what we keep seeing, because honestly, what's happening now is moving faster than I would've predicted twelve months ago.

The collapse curve

Time from CVE disclosure to first observed exploit. That number was 771 days in 2018. Six days by 2023. Four hours by 2024. In 2025, the majority of exploited vulnerabilities were already weaponized before any public disclosure existed.

That isn't a trend. It's a collapse. Zero Day Clock tracks this across 83,000+ CVEs, and the curve fits an exponential decay model. Worth a look.

The cause isn't a mystery anymore. AI.

• In February, Anthropic's red team announced that Claude had found 500+ high-severity vulnerabilities in widely used open-source software. Bugs that survived decades of expert human review.
• Sean Heelan ran AI agents that produced 40 working exploit chains for one vulnerability, each bypassing different mitigation combinations (ASLR, CFI, hardware protections, sandboxes). $50 of inference. His takeaway: state-level exploit production is now bounded by token throughput, not how many hackers you employ.
• Researchers turned AI agent swarms loose on Windows kernel drivers and surfaced 100+ exploitable bugs across AMD, Intel, NVIDIA, Dell, Lenovo, and IBM. 30 days, $600 total. Four bucks a bug.
• Stanford and CMU ran a research-grade AI agent on a real 8,000-machine enterprise network. It beat 9 of 10 certified human pen testers at a third of the cost per hour.

The cost of being a viable attacker keeps falling while the attack surface from AI-generated code is increasing. Defense costs aren't moving.

Why we ignored the edge — and why we were right to

There's a lot of dishonest vendor marketing in this category. I'm trying not to add to it.

EDR is good, run it. MDR is good, pay for it. Identity controls, segmentation, ASM, vuln management, internal canary tooling: all of it, do all of it. Nothing in this post is an argument against any of that.

But if you've been treating your edge as something the firewall handles and the rest of your stack ignores, you had reasons.

Rewind 20 years. We did try watching the perimeter. IDS on every external interface. The thing lit up on every benign scan, every Shodan crawler, every script kiddie banging on port 22. Signal-to-noise was so bad that the industry made a pretty rational call: stop trying to catch them at the door, catch them once they're inside. That's where assumed-breach came from.

It was the right call. Reconnaissance has always been the most information-rich window in an attack. But there was nothing productive you could do with that data in 2005, so we stopped paying attention to it.

The edge has always mattered. The shift now is just that there's finally something useful you can do at the edge to tilt the attack/defense economics in your favor. The only advantage you now retain as a defender: which edge endpoints are real and which are landmines?

When does the MTTD clock actually start?

Something that's been on my mind.

We talk about mean time to detect like the number means something. But MTTD only starts ticking once you have the ability to detect something, and in most stacks today, the earliest moment that's true is at initial access. A payload running, an implant beaconing, a session that has no business existing.

The recon, the credential testing, the subdomain enumeration, the fingerprinting? Your stack doesn't see any of it. So the MTTD you're walking into your board meeting with isn't really measuring how fast you detected an attack. It's measuring how fast you detected an attack after the attacker was already inside.

Then layer in the asymmetry. Defenders have to be right every time. Every asset, every patch cycle, every config. Attackers find one flaw, once. AI just collapsed the cost of finding it to single-digit dollars.

You don't fix that by being incrementally better at the things you're already doing. The only structural move is detecting the adversary before their first success. Catch them at recon, before they've touched your real assets, and the math finally tilts your way. That's where the clock should start.

The hypothesis

Here's the hypothesis. Calling it that on purpose, because the sky isn't falling yet.

Organizations will no longer be able to ignore the recon phase at the perimeter.

The perimeter didn't suddenly get scarier. What changed is the gap between an attacker showing up at your edge, and that attacker landing a working exploit on it. That window has compressed from years to hours. The reconnaissance phase, the time when someone is fingerprinting you, mapping you, deciding whether you're worth their time, used to be a luxury for them and an irrelevance to you. Now it's the only window you actually have.

If your detection starts at initial access, you've already given up the advantage of time. Attackers often have multiple credentials and footholds by the time EDR chirps. When AI-generated exploits show up faster than your patch cycle can ship, “detect on initial access” is just “detect after breach.”

Most stacks aren't built for this. Pull up your tooling and look at where each piece actually fires. Endpoint fires on a running payload. Network fires on an implant beaconing out. SIEM lights up on weird auth. SOC playbooks kick in once something has landed. All useful. All firing well after the attacker is done picking you and has lined up the shot.

The edge is where they chose you. That used to be an unactionable signal. It isn't anymore.

The closer

You have been able to ignore this for a while. That is changing.

I'm not telling you to rip anything out of your stack. I'm telling you to look at where it actually starts firing and ask whether “at initial access” will hold up over the next 18 months.

That's the bet we made when we built Divert. Three things matter here.

We block. Not just alert. We catch attackers in recon, route them into diversions, profile them, and shut them down before they reach anything real. By the time a SOC opens an alert about an edge probe, the attacker's already moved on. Detect-then-respond no longer fits this timeline.

We score who's actually skilled. Most of what hits your edge every day is automated noise. Some of it isn't. We tell you which is which, so your team stops spending attention on the wrong stuff.

Deployment is in hours. It runs on its own after that. No SOC tuning, no headcount dedicated to managing it. The point is to give you time back, not eat more.

If you're a security leader sitting on an edge that nobody on your team is really watching, and you want to know what an attacker actually sees when they look at your org right now, talk to me, or feel free to contact us. DMs are open.