Threat Intelligence Alone Won't Close the Exploitation Gap

Summary

Attackers are accelerating breaches by combining threat intelligence with AI-assisted exploitation, outpacing traditional security team responses. The delay in triaging and validating threat indicators creates a 'queue where risk accumulates.' Threat-led penetration testing (TLPT) and automated security validation platforms are emerging as solutions to bridge this gap by rapidly testing the exploitability of specific threats in real environments.

Full text

Threat Intelligence Alone Won't Close the Exploitation Gap The Hacker NewsSep 16, 2026Threat Intelligence / Security Validation A leaked credential shows up in a criminal marketplace, or a vulnerability gets a disclosure advisory, and either one can be weaponized against a real target before most security teams have triaged the alert. Attackers are combining that kind of intelligence with AI-assisted exploitation to accelerate the path from exposure to breach faster than most security programs are built to react. Intelligence is still the earliest signal defenders get, and a leaked credential turning up in a feed is proof of how useful that signal has become. The problem sits one step later, in what happens after the signal arrives. The Queue Where Risk Accumulates In most organizations, a high-value indicator waits in a queue instead of getting acted on right away, until someone with the offensive skill to test it actually has the time to determine whether it's exploitable in that specific environment, on that specific day. That queue, more than any shortage of intelligence, is where exposure builds up. This shows up on both sides of the industry. Security teams describe it as a backlog problem. Speaking with the product teams of Recorded Future, the world’s largest threat intelligence company, I've heard the same pattern from their side: the volume of relevant threat data outpaces most teams' capacity to test each item against a live environment, and validating at that scale is limited by time and specialized offensive skill, not by a lack of data. From Probability to Proof That's part of why threat-led penetration testing, TLPT, moves beyond a compliance requirement in a handful of regulated sectors and into a broader operating model. TLPT starts from what current intelligence says is actually happening: a specific leaked credential, a specific disclosed vulnerability; and tests for that directly instead of working through a static backlog on a fixed calendar. For a leaked credential specifically, TLPT is built to return evidence: this exact credential is or isn’t exploitable in this exact environment right now. That's where a lot of security teams say they want to spend their limited testing capacity. What This Looks Like in Practice Pentera's collaboration with Recorded Future is one example of this shift taking shape, and it's the one I know best. The integration is built so that a threat signal, whether it originates from Recorded Future, from Pentera's own platform, or from another intelligence source, can trigger an automated validation run against the organization's real attack surface. The first capability built on this connects Recorded Future's leaked-credential intelligence to automated testing of an organization's external attack surface, confirming which exposed credentials can be used by an attacker to exploit a certain environment, rather than flagging all of them as equally urgent. One of the customers involved in early testing described the shift in plain terms. Joseph Gothelf, Vice President of Cybersecurity at Wyndham Hotels & Resorts, said: "The convergence of threat intelligence and security validation is one of the most important shifts in our security program. Knowing what's coming is only half the answer. Being able to test against it in our own environment, at speed, is what builds real resilience in the AI era." Recorded Future's feed surfaces a leaked credential the same way it would for any customer running it. Whether that specific credential still works against a specific environment, regardless of which vendors are involved in surfacing or testing it, is what most security programs still can't answer quickly. That's the gap I'd put security budget against before another intelligence feed: not knowing more, but proving what's already known. To learn more, join the “Threat Intel' Just Got Teeth, TLPT Goes Live” webinar on September 29. Note: This article has been expertly written and contributed by Doron Naim, VP Strategic Alliances, Pentera. Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Identity Security, Penetration Testing, Security Validation, Threat Intelligence ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibility Into 90% of Attacks Within 60 Seconds Benchmark Your SOC's AI Adoption With the 2026 Security Operations Report Register for LDR516: Strategic Vulnerability and Threat Management at SANS DC Metro

Entities