Antani: 50% of CISA known exploited vulnerabilities remain unpatched after two months
Snehal Antani · How AI's Top New Models Transform Cybersecurity (And Where They Don't) — With Snehal Antani · Jul 29, 2026 · at 10:35
Horizon3.ai CEO Snehal Antani discusses why attackers successfully exploit newly published security patches before companies update systems.
0:00 / 0:07exact quote · 7.8s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“Well, 50% of CISA KEVs are still unpatched two months after notification.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Snehal Antani
Antani: AI Models Fail When Attacking Actively Defended Networks
“These models work really well, especially from a cyber standpoint in lab environments, cyber ranges and so on, but they're actually not good at all in, in, in networks that are actively fighting back and networks that are actively defending themselves in netwo…”
Antani: AI Models Trigger Cyber Decoys 92% Of The Time Versus Humans
“An expert human clicks on those decoys, 37% of the time. Four, six, four, seven, four, eight, click on those decoys, 92% of the time. More than twice as much as an expert hacker.”
Antani: AI Models Are Disposable; Data and Harnesses Are Durable
“At the end of the day, the models in AI are disposable. The weights are going to change. The models are going to come out. That doesn't matter. What's durable in AI is the harness and the training data.”
Antani: Frontier AI models are nowhere near fully autonomous cyberattacks
“For an, a collection of agents to do all of that in kind of a one shot push button go in an environment that's changing and actively fighting back. We're nowhere near that. Right. At least on the frontier model side.”
Antani: 86% of Claude Code tokens are spent fixing its own errors
“And the, these models, I was reading a research paper, 86% of the tokens spent by cloud code are spent fixing mistakes cloud code made.”
Antani: Enterprise AI agent security must extend insider threat programs
“So I think that agent security and insider threat tactics are going to look, or insider threat security tactics and processes are going to look very similar. And I would actually argue agentic security should be an extension of your insider threat program.”