In September 2026, researchers reconstructed a campaign that should change how we think about risk. Autonomous agents — built from open-source orchestration tools driving commercial language models — compromised at least 27 organisations and harvested more than 600,000 payment-card records. The researchers put the attacker’s cost at roughly $25 per target.
The organisations that were hit were not running exotic software. They ran the same kinds of systems, with the same kinds of weaknesses, as everyone else. What was different was not the vulnerability. It was the exposure.
Vulnerability is a property of the software. Exposure is a property of the deployed surface.
A vulnerability is latent and shared: it exists in the code whether or not anyone ever touches it, and the same weakness can exist everywhere that software is deployed. Exposure is lived and specific: it is what is actually happening — right now, against a particular surface, by particular actors, behaving in particular ways.
Security has become extraordinarily good at describing vulnerabilities. It has become much less good at preserving a comparable, longitudinal record of the conduct actually arriving at each individual surface.
The vulnerability stack tells us important things. CVE tells us a weakness exists. CVSS tells us how severe exploitation could be. KEV tells us that exploitation is known to have occurred in the wild. But none of these tells us what is happening against your surface.
The limits of the catalogue are no longer a matter of opinion. In April 2026, as vulnerability volume outran the capacity to assess it, NIST shifted the National Vulnerability Database from enriching every entry toward prioritising by risk — concentrating on vulnerabilities in the CISA Known Exploited Vulnerabilities catalog, in software used by the federal government, and in critical software. The rest may be marked “not scheduled.” The operational question is moving from “what vulnerabilities exist?” to “which conditions actually matter here?” A catalogue alone cannot answer that. The deployed surface contains information the catalogue does not.
Two organisations could carry the identical vulnerability — same CVE, same CVSS, neither flagged in KEV — and be in completely different situations. One sees little more than background internet noise. The other is under reconnaissance, repeated probing, adaptive requests, and persistent actors that change their behaviour based on how the surface responds. The researchers reported exactly this: the agents applied different strategies to each company despite identical objectives. On paper the vulnerability was the same. At the receiver, the exposure was not.
And note how the campaign came to light: not because the organisations had a record of what happened at their own surfaces, but because the attacker left a server exposed. The account was reconstructed from the attacker’s own infrastructure, after the fact. The parties on the receiving end could not, on their own, have told you what actually arrived at their door.
Identity tells you who an actor claims to be — and identity can be borrowed, pooled, proxied, relayed, and spoofed. Conduct tells you what the actor actually did, and it plays out against your surface, where it is far harder to fake. When an actor adapts in real time, a static vulnerability record cannot represent it. Only observation of the surface can.
And the actor cannot be its own witness. What actually happened has to be established by a record kept independently of it. The receiver owns the surface; an independent party attests to what was observed there — verifiable by anyone, without having to trust either of them.
None of this argues against the monitoring an organisation already runs. Most receiving surfaces already watch their traffic — and block what they can name, as one marketplace recently did when it shut out a prominent shopping agent. But that is identity-based defence: it stops the agent that declares itself, or is already known. It does not separate the undeclared agent, or the one imitating an ordinary user, by what it actually does — and a surface’s own monitoring, run by the party doing the deciding, is not an independent account of what happened when that decision is later questioned. Conduct, recorded independently, is the layer in-house monitoring structurally cannot be.
The catalogue will remain essential. But it describes the software, the same way for everyone who runs it. As autonomous actors get cheaper, faster, and more adaptive, the question that decides outcomes is no longer only which weaknesses exist — it is what is actually arriving at each surface, and whether there is an independent record of it when it matters.
