VulnOps:
why continuous security operations are no longer optional asUgo Together, Connecting U to your customers
2026
1 The acceleration problem 2 Europe in the crosshairs 3 Where defences fail 4 Why traditional approaches fall short 5 The 2030 horizon: quantum meets AGI 6 The case for VulnOps 7 The adversary landscape 8 AI security: the defender's imperative 9 Building VulnOps: where to start 10 Executive summary
AI-driven threats are accelerating so rapidly that continuous Vulnerability Operations (VulnOps) is now essential.
Table of Contents
How AI-driven vulnerability discovery has collapsed the window between disclosure and exploitation to less than a day.
The regional threat landscape, breach economics, and why Belgian and Benelux organisations face disproportionate risk.
Intrusion vectors, the expanding attack surface, and the root cause visibility gap that leaves organisations exposed.
The compliance trap, the patch paradox, and why periodic assessments cannot keep pace with continuous threats.
Two existential technology shifts converging on the same timeline - and why the window for action is closing.
Four pillars of continuous security operations - and how they address the root causes of organisational exposure.
Ransomware as an industry, nation-state convergence, and the 281 adversary groups targeting European organisations.
Why organisations must secure their AI deployments and leverage AI to match the speed of AI-powered attackers.
Nine practical, high-impact steps to build toward mature continuous security operations.
2
1. Executive summary In April 2026, Anthropic unveiled Claude Mythos - an AI model capable of autonomously discovering thousands of zeroday vulnerabilities across every major operating system and browser, with a 72% exploit success rate. The CSA CISO Community, SANS, and OWASP responded with an urgent strategy briefing: the window between vulnerability discovery and weaponisation has collapsed to less than a day. This is not a future risk. It is the present reality.
Traditional security approaches - quarterly penetration tests, annual compliance audits, reactive patching cycles - were designed for a world where threats evolved at a human pace. That world no longer exists. What is needed is a fundamental shift toward Vulnerability Operations (VulnOps): the continuous, intelligence-driven practice of monitoring, discovering, and remediating security weaknesses across the entire attack surface, in real time. This whitepaper makes the case for VulnOps by synthesising the latest threat intelligence, breach economics, and AI-driven risk acceleration. It draws on authoritative sources including IBM's Cost of a Data Breach Report, Verizon's DBIR, CrowdStrike's Global and European Threat Reports, Belgium's CCB annual review, Akamai's ransomware analysis, the CSA/SANS AI Vulnerability Storm briefing, and Alice & Bob's quantum computing roadmap.
For European enterprises - and Belgian organisations in particular - this acceleration compounds an already severe threat landscape. Breach costs in the Benelux region have reached €5.4 million on average. Belgium recorded a 70% surge in cyber incidents in 2025. Ransomware appears in 44% of all breaches globally. And adversaries now move from initial access to lateral movement in under 30 minutes.
<1 day Time from vulnerability discovery to exploit
€5.4 mln
29 min
89%
Average breach cost in the Benelux
Adversary breakout time (avg. breakout time)
Increase in AIenabled attacks in 2025
€1.8M
~2030
Savings per breach with AI and automation
Q-Day and AGI convergence on the same timeline
3
The VulnOps Framework
Our approach: threat-based, not compliance-driven
We start from real threats - what can actually happen to your organisation given your specific adversary landscape - not from generic asset inventories or compliance checklists. Our HORUS assessment simulates realistic adversary attack scenarios against your crown jewels, identifies root causes, and builds a VulnOps programme that delivers the highest security value for your investment. VulnOps is the convergence of four disciplines into a single, continuous operational practice designed to identify your organisation's security root causes and address them based on real threat exposure, not compliance checklists.
Continuous vulnerability management
Continuous threat intelligence
Attack surface management
4
Streamlined remediation
2. The acceleration problem The cybersecurity landscape has always been an arms race, but 2025 and 2026 have introduced a qualitative shift that changes the terms of engagement. AI-driven vulnerability discovery is no longer theoretical - it is operational, and it is accelerating at a pace that outstrips the defensive capacity of most organisations.
HackerOne's leaderboard in June 2025, Google's Big Sleep finding 20 real zero-days in August 2025, DARPA's AIxCC discovering 54 vulnerabilities in four hours, and Sysdig documenting an AI-based attack achieving admin access in just eight minutes. The CSA/SANS briefing is unequivocal: Mythosclass capabilities will proliferate to openweight models within six months to a year.
The structural asymmetry The challenge is structural. AI lowers the cost and skill floor for discovering and exploiting vulnerabilities faster than organisations can patch them. CrowdStrike's 2026 Global Threat Report documents an 89% increase in AIenabled attacks and a 42% rise in zero-day exploitation. The average eCrime breakout time has fallen to 29 minutes - 65% faster than the prior year - with the fastest observed case at 27 seconds. Meanwhile, 82% of detections in 2025 were malware-free, relying on legitimate tools and stolen credentials that traditional signature-based defences cannot catch.
Time-to-exploit has collapsed from 2.3 years in 2018 to less than one day in 2026. Adversaries now discover and weaponise vulnerabilities faster than most organisations can schedule a patch window.
Mythos and Fable moment
Anthropic's Claude Mythos represents a step change in offensive AI capabilities. Internal testing showed the model generating 181 working exploits on Firefox where the previous generation succeeded only twice under identical conditions. Mythos identifies complex, chained vulnerabilities - multiple memory corruption bugs combined into single exploit paths - and accomplishes this autonomously, without elaborate scaffolding or agent configuration. The scale of Anthropic's Project Glasswing disclosure, coordinating patches across 40 major vendors simultaneously, illustrates the breadth of the vulnerability surface that AI can now enumerate.
29 min
Average adversary breakout time down 65% year-over-year. Fastest observed: 27 seconds. For defenders, the implication is clear: the patch-and-pray model is broken. When vulnerabilities can be discovered and weaponised in hours, monthly or quarterly patch cycles leave organisations exposed for the vast majority of the window that matters.
But Mythos is not an isolated event. It sits atop 5
3. Europe in the crosshairs This acceleration does not occur in a vacuum. It compounds an already intense threat environment for European enterprises. Understanding the regional landscape is essential for calibrating the urgency of a VulnOps approach.
Europe is the second most targeted region globally, with approximately 2,100 organisations named on data leak sites since January 2024 - a 13% year-over-year increase. Belgium alone had 46 companies with active breaches on dark markets in 2025. The Belgian Centre for Cybersecurity recorded 635 incident notifications, a 70% surge, with account compromise (26%) and ransomware (19%) leading the categories. Belgium was singled out among Europe's most targeted nations by pro-Russian hacktivist groups.
€5.4 mln
Average cost of a data breach in the Benelux - 3rd costliest region globally
13%
From 2024 to 2025
46
Source: CrowdStrike 2025 European Threat Landscape Report
Manufacturing Professional services Technology Industrial and Engineering Retail Healthcare Academic Financial Services Automotive Food and Beverage
1380 EU Published data leakage in 2025
BE Companies with active breach available on dark market in 2025
0
50
100
150
Source: CrowdStrike 2025 European Threat Landscape Report
6
200
250
300
Why cyber security & privacy is necessary Costs and investments statistics in Benelux for 2025
€5.4m Average cost of a data breach
154 EUR / IP record 141 EUR / PII record
Average Cost Details
6%
Source: asUgo analysis based on IBM Cost of a Data Breach Report 2025
From 2024 to 2025
Forensic and investigative activities Assessment and audit services Crisis management Communications to executives and boards
Emails, letters, outbound calls or general notices to data subjects Determination of regulatory requirements Communication with regulators Engagement of outside experts
Help desk and inbound communications Credit monitoring and identity protection services Issuing of new accounts or credit cards Legal expenditures Product discounts Regulatory fines
Business disruption and revenue losses due to system downtime + Cost of losing customers and acquiring new customers + Reputational damage and diminished goodwill Source: asUgo analysis based on IBM Cost of a Data Breach Report 2025
7
4. Where defences fail: the attack surface reality
60%
If the acceleration problem tells us that threats are moving faster, the intrusion vector data tells us precisely where defences are failing and why a continuous approach is the only viable response.
Phishing
Initial infection vector Phishing Botnet
Including vishing and malvertising
Vulnerabilities
21%
Malicious applications Insider threat
External vulnerabilities Exposed assets
8.00% 9.90%
Main root causes Security awareness & culture
21.30%
60.00%
(New) Attack surface management Supply chain detection and response
OT
AI systems Asymmetric encryption
Source: asUgo analysis based on ENISA Threat Landscape 2025
The expanding attack surface
Vulnerability exploitation now accounts for 20% of all breaches, surging 34% year-over-year. Edge devices - firewalls, VPN concentrators, remote access gateways - have become the primary target, with Verizon reporting an eightfold increase in edge-device targeting. Only 54% of affected edge devices were fully remediated during the year. The median time to remediate was 32 days an eternity when adversaries weaponise vulnerabilities within hours. Credential abuse remains the single most prevalent vector at 22% of breaches globally, with CrowdStrike identifying 260 initial access brokers advertising network access to over 1,400 European entities. The human element persists in 60% of all breaches, and phishing carries the highest average cost at €4.4 million per incident. AI is amplifying these threats: synthetically 8
generated malicious email text has doubled over two years, and GenAI now reduces the time to craft a convincing phishing email from 16 hours to just 5 minutes.
The root cause problem
These vectors share a common root cause: organisations lack continuous visibility into their own exposure. They do not know, in real time, which assets are internet-facing, which vulnerabilities are actively exploitable, or how their attack surface has changed since the last assessment. This is not a technology gap alone - it is an operational gap. The CSA/SANS briefing identifies "Incomplete Asset and Exposure Inventory" as a high-severity risk, noting that AI-accelerated capabilities mean attackers can now scan an entire OS codebase at accessible cost and enumerate exposure faster than defenders can inventory it.
Advanced cyber security services
Specific cyber security services
Essential Cyber security services
Cost-reducing factors DevSecOps approach AI-driven and ML-driven insights Security analytics or SIEM Threat intelligence Encryption SOAR tools Quantum security tools Proactive threat hunting Employee training AI governance technology IAM Machine learning SecOps Offensive security testing Endpoint detection and response Gen AI security tools Attack surface management Data security and protection software AI governance policies Managed security provider (MSSP) CISO appointed Board-level oversight
-4.7% -4.6%
≈ -200K EUR
-4.3% -4.3% -4.3% -4.1% -4.0% -4.0% -3.9% -3.9% -3.9% -3.8% -3.8% -3.5% -3.3% -3.3% -3.2% -3.0% -2.6% -2.3% -2.3%
9
≈ -100K EUR
Cost-increasing factors Supply chain breach
+4.7% +4.3%
Security system complexity
+4.1%
Shadow AI
+4.0%
Adoption of AI tools
≈ +200K EUR
+3.6%
IoT and OT environment impacted
+3.6%
Migration to the cloud
+3.6%
Noncompliance with regulations
+3.6%
Security skills shortage Remote workforce
+2.7%
≈ +145K EUR
The ROI data reinforces the urgency. DevSecOps approaches reduce breach costs by 4.7%, AI/ML-driven insights by 4.6%, security analytics by 4.3%, and threat intelligence by 4.3%. These are precisely the capabilities that a VulnOps programme integrates into a continuous operational discipline. Conversely, the top cost-amplifying factors - supply chain breaches (+4.7%), security system complexity (+4.3%), shadow AI (+4.1%) - all reflect the consequences of fragmented, reactive security postures.
≈ €200K
≈ €145K
Annual cost exposure
Potential cost avoidance
Up to 4.7% Reduction in breach-related costs
10
5. Why traditional approaches fall short The compliance trap
Regulatory frameworks like NIS2, DORA, and the EU Cyber Resilience Act represent important baselines, but they are inherently backward-looking. Compliance cycles operate on annual or semi-annual timelines. Certification audits assess a point-in-time snapshot. By the time an organisation achieves compliance, the threat landscape has moved on. The CSA/SANS briefing makes this explicit: pre-AI assumptions about patch windows, exploit scarcity, and incident frequency may no longer hold. Security reporting metrics built on these assumptions could lead to underfunding of the very controls that prevent incidents.
perpetually behind. The CSA/SANS report rates "Prepare for Continuous Patching" as a critical priority action with a 45-day horizon.
<1 day Time from vulnerability discovery to weaponised exploit in 2026 - down from 2.3 years in 2018
Quarterly pen tests and reactive patching cycles were designed for a world of dozens of critical CVEs per month. AI-driven discovery is generating hundreds. The CVE system itself may not scale.
The patch paradox
Patching remains essential but is no longer sufficient as a standalone strategy. The Mythos disclosure alone triggered a coordinated patch wave across 40 vendors and this is described as the first of many such waves. Linux kernel bug reports have climbed from 2 to 10 per week, all now verified as real. The volume of AI-discovered vulnerabilities will overwhelm existing triage and deployment capacity, and organisations that rely on scheduled patch windows will find themselves
Beyond volume, there is a quality problem. When dozens of critical patches arrive simultaneously, development and operations teams face a backlog with poor consistency in prioritisation and unclear remediation instructions. Without a structured, continuous approach, patching becomes reactive firefighting rather than systematic risk reduction. 11
6. The 2030 horizon: when quantum meets AGI Q-Day: the quantum threat is not theoretical
Q-Day - the moment a cryptographically relevant quantum computer can break widely used public-key encryption such as RSA-2048 - is no longer a distant scenario. Multiple expert assessments now place it between 2029 and 2035, with growing consensus that the early 2030s are realistic. In March 2026, three research papers published within three months prompted The Quantum Insider to declare that the quantum threat timeline is being rewritten.
Two transformative technologies are converging on the same timeline. Quantum computers capable of breaking current encryption and artificial general intelligence capable of autonomous offensive operations are both projected to arrive around 2030. The security implications are without precedent.
resource estimates that define the threat. The European Commission unveiled a coordinated roadmap in June 2025 requiring high-risk systems, including critical infrastructure, to be secured with post-quantum cryptography by the end of 2030. Crucially, the threat does not begin on Q-Day. Nation-state adversaries are already conducting "harvest now, decrypt later" operations - intercepting and storing encrypted data today with the intention of decrypting it once quantum capabilities mature. For organisations handling sensitive data with long-term confidentiality requirements (intellectual property, patient records, government communications, trade secrets), the window for action is effectively already closing. If that data needs to remain confidential for 10 or more years, and it takes 5 to 10 years to migrate cryptographic systems, the time to act is now.
~2030
Estimated convergence of QDay and AGI - two existential technology shifts on the same timeline
The patch paradox
Alice & Bob, the French quantum computing company, published a detailed roadmap in December 2024 targeting a useful, faulttolerant quantum computer with 100 highfidelity logical qubits by 2030. Google has set an internal 2029 deadline for completing its own post-quantum cryptography migration - a signal that carries particular weight given that Google's own researchers produce the
AGI: autonomous offensive AI on the horizon
In parallel, the trajectory toward artificial general intelligence - AI systems matching or exceeding top human cognitive capabilities across domains - is accelerating faster than most forecasters anticipated. A 145-page research paper from Google DeepMind, published in April 2025, concluded that AGI 12
matching top human skills could arrive by 2030. Demis Hassabis, DeepMind's founder, estimated AGI at three to five years away as of January 2025. Anthropic stated in its March 2025 recommendations to the White House that it expects "powerful AI systems" to emerge in late 2026 or early 2027. Sam Altman declared in January 2025 that OpenAI is "now confident" it knows how to build AGI. For cybersecurity, the implications are stark. If Mythos - operating well below the level of general intelligence - can already discover thousands of zero-days autonomously, what happens when AI systems achieve humanlevel reasoning across all domains? The CSA/SANS briefing is explicit: Mythos-class capabilities will proliferate to open-weight models within months, and subsequent generations will be substantially more capable. The gap between offensive AI capability and defensive preparedness risks becoming unbridgeable if organisations do not act now.
The convergence risk
The simultaneous arrival of quantum computing and AGI around the 2030 timeframe creates a compounding threat. Quantum breaks the cryptographic foundations that underpin trust in digital systems. AGI automates the discovery and exploitation of every other type of vulnerability at machine speed. Together, they represent a fundamental challenge to the security model that most organisations operate today. Organisations that are not already building continuous security operations - including cryptographic inventory management, postquantum migration readiness, and AIaugmented defence - will face a threat landscape for which periodic, compliancedriven approaches are structurally inadequate.
13
7. The case for VulnOps Vulnerability Operations (VulnOps) is the convergence of multiple security disciplines into a single, continuous operational practice -
designed not for the threat landscape of five years ago, but for the AI-accelerated reality of today.
Continuous vulnerability management
Attack surface management
Continuous threat intelligence
Streamlined remediation
Beyond periodic scans: real-time discovery, AIaugmented prioritisation, and automated remediation pipelines that match the speed of adversary exploitation.
Continuous mapping of the external and internal attack surface - assets, dependencies, shadow IT, cloud configurations because you cannot defend what you cannot see.
Operationalised intelligence that tracks emerging threats, adversary TTPs, and vulnerability weaponisation in real time, feeding directly into prioritisation and response.
Organised, consistent vulnerability remediation for development and operations teams: clear priorities, actionable instructions, and manageable backlogs rather than ad-hoc firefighting.
Why these dimensions together Each dimension addresses a distinct part of the problem. Continuous vulnerability management ensures that newly discovered weaknesses - whether from AI-driven research, vendor disclosures, or internal code changes - are identified and remediated before adversaries can exploit them. Attack surface management provides the foundational visibility without which vulnerability management operates blind: you cannot patch an asset you do not know exists, and the proliferation of cloud services, APIs, and AI-generated code is expanding the attack surface faster than traditional inventory methods can track. Continuous threat intelligence closes the loop by ensuring that prioritisation reflects actual adversary behaviour, not theoretical severity scores. And streamlined remediation ensures that the
teams who must actually fix the vulnerabilities developers, sysadmins, DevOps engineers receive clear, prioritised, and actionable guidance rather than an overwhelming backlog of inconsistent tickets.
The root cause approach
VulnOps is not merely a faster version of existing vulnerability management. It represents a shift from treating symptoms to identifying security root causes. When an organisation discovers that 60% of its incidents trace back to unpatched edge devices, that is a root cause. When credential compromise accounts for a quarter of all incidents, that points to a fundamental identity architecture gap. When third-party dependencies introduce 30% of breaches, that reveals a supply chain visibility deficit. 14
VulnOps provides the continuous operational lens to surface these patterns, track them over time, and measure the effectiveness of remediation.
Meeting the adversary's speed
The CSA/SANS briefing explicitly calls for organisations to "Stand Up VulnOps" as Priority Action 11 - rated critical. Their definition aligns precisely with the operational model we advocate: a permanent function, staffed and automated like DevOps, but for autonomous vulnerability research and remediation. This is the discipline that owns continuous discovery of zero-day vulnerabilities across the entire software estate and establishes automated remediation pipelines. Without it, organisations are structurally unable to match the speed at which AI-powered adversaries now operate.
15
8. The adversary landscape: Why Speed Matters
The case for VulnOps becomes even more urgent when viewed through the lens of who is attacking European organisations, and how quickly the threat ecosystem is evolving.
<= 2025 Qilin
INC Ransom
Clop
Akira
Everest
WorldLeaks
LockBit 3.0
Ransomware groups observed for several years, including Qilin, Clop and Akira
>= 2025 Qilin
SafePay (Coinbase Cartel)
Wirebit
Nova
TridentLocker
Ghost (Cring)
Radar
Crypto24
Cinnamon Tempest
Morpheus
Ransomware groups observed for the first year, such as Lynx and SafePay Coinbase Cartel Source: asUgo analysis based on CCB Belgium 2025 and Rapid7 Q3 2025 Threat Landscape
16
Ransomware: an industrial economy
assessments, the message is clear: the adversary ecosystem evolves continuously. Quarterly snapshots cannot capture the emergence of new ransomware groups, the weaponisation of fresh zero-days, or the shift in nation-state targeting priorities. Only a continuous operational model - VulnOps - can maintain the real-time awareness needed to respond at the speed the threat environment demands.
Ransomware now appears in 44% of all breaches globally, a 37% increase year-overyear. For SMBs - the backbone of the Benelux economy - the figure reaches 88%. The ecosystem has matured into an industrial operation: 88 active ransomware groups were observed in Q3 2025 alone, up from 65 in the prior quarter. In Europe, Akira (167 victims), LockBit (162), and RansomHub (141) dominate, while Belgium specifically faces Qilin, Akira, and Clop. The evolution from single extortion to quadruple extortion adding DDoS attacks and direct pressure on customers and regulators - maximises pressure to pay.
281 adversary groups tracked globally. 24 newly identified in the past year. 82% of detections are malware-free. Traditional signature-based defences miss the majority of modern attacks.
Nation-states and the blurring line
State-sponsored activity against European targets has intensified. CrowdStrike tracks 281 adversary groups, with China-nexus activity up 38% and Russia-aligned operations continuing to target EU institutions, critical infrastructure, and defence organisations. Cloud intrusions rose 37% overall and 266% for state actors. The line between criminal and state-sponsored activity is increasingly blurred, with groups like WIZARD SPIDER supporting Russian military objectives and nation-state actors exploiting criminal MaaS offerings for espionage. For organisations relying on periodic security 17
9. AI security: the defender's imperative AI is not only reshaping the threat landscape it is also transforming every organisation that seeks to remain competitive. Enterprises across all sectors are adopting AI for productivity, customer engagement, and decision-making. This adoption is not optional: organisations that fail to integrate AI risk falling behind competitors who do. But every AI deployment creates new attack surface, and most organisations are not yet securing it.
97% of AI-related breaches involved organisations that lacked proper AI access controls. AI is both the threat and, increasingly, the only viable defence at scale.
AI is now a dual threat
It acts as a force multiplier for cyberattacks while introducing a new attack surface. asUgo supports you securing AI adoption, establish a framework, preventing data leaks, secure AI agents, applications, models and underlying infrastructure.
asUgo AI Cyber Security framework
AI Red Teaming
Agentic application security
AI cyber threat intelligence
Prompt injections, data & model poisoning, RAG manipulation
Agent goal hijack, Agentic supply chain vulnerabilities
External adversary tactics and techniques in realworld attack observations
89%
97%
Companies with AI-related breaches lacked proper AI access controls
Increase in global AI-enabled attacks in 2025
Source: IBM Cost of a Data Breach Report 2025 and CrowdStrike 2026 Global Threat Report
18
AI as attack surface
AI as a defence multiplier
IBM's 2025 Cost of a Data Breach Report found that 97% of AI-related breaches involved organisations lacking proper access controls for their AI tools. CrowdStrike documents an 89% increase in global AIenabled attacks in 2025. The attack vectors are expanding rapidly: prompt injection, data and model poisoning, RAG manipulation, agent goal hijacking, agentic supply chain vulnerabilities, and shadow AI deployments operating outside security governance.
The flip side is equally important: defenders who do not leverage AI will not be able to keep pace with attackers who already do. When adversaries use AI to generate phishing campaigns in minutes, discover zero-days autonomously, and automate lateral movement, the only viable response is to deploy AI-augmented defences. IBM's data shows that organisations with extensive AI and security automation saved €1.8 million per breach compared to those without. DevSecOps approaches powered by AI reduce breach costs by 4.7%, and AI/ML-driven security insights reduce them by a further 4.6%.
Organisations need an AI security framework aligned with recognised standards such as NIST AI RMF, Google's Secure AI Framework (SAIF), OWASP's GenAI Security Project, and MITRE ATLAS. This means AI red teaming to test for adversarial weaknesses, agentic application security to govern autonomous AI systems, and AI-specific cyber threat intelligence to track real-world attack techniques targeting AI infrastructure.
This is not about replacing human analysts. It is about augmenting them. AI can triage thousands of vulnerability alerts, correlate threat intelligence feeds in real time, automate routine patch testing, and flag the anomalies that warrant human investigation. In a VulnOps model, AI integration is not a nice-tohave - it is a structural requirement for operating at the speed the current threat landscape demands. The blue team must adopt the same tools the red team is already using.
asUgo AI Security Foundations
We align our security approach with recognised frameworks such as NIST AI RMF, Google Secure AI Framework (SAIF) or OWASP and MITRE frameworks:
Source: asUgo analysis based on CCB Belgium 2025 and Rapid7 Q3 2025 Threat Landscape
19
10. Building a VulnOps capability: where to start The shift to VulnOps need not be a wholesale transformation overnight. It can begin with practical, high-impact steps that build toward a mature continuous security operation: Establish continuous asset visibility. You cannot defend what you cannot see. Begin with a comprehensive inventory of internet-facing assets, cloud configurations, APIs, and third-party dependencies. Extend to internal assets and shadow IT. This is the foundation on which every other VulnOps capability depends. Operationalise vulnerability prioritisation. Move beyond CVSS scores to risk-based prioritisation that incorporates threat intelligence, asset criticality, and exploitability data. A CVSS 7.0 vulnerability on an internet-facing edge device actively targeted by ransomware groups demands different urgency than a CVSS 9.0 on an isolated internal system. Streamline remediation for the teams that patch. Ensure that developers and operations teams receive clear, consistent, and prioritised remediation instructions rather than an overwhelming backlog of vague tickets. Structured remediation workflows reduce mean time to patch, prevent critical fixes from getting lost in noise, and build a sustainable patching cadence. Automate where possible, augment where necessary. AI-powered vulnerability scanning, automated patch testing, and pre-authorised containment reduce the human bottleneck. IBM shows organisations with extensive AI and automation saved €1.8M per breach. But governance is critical: 97% of AI-related breaches involved organisations lacking
proper access controls. Integrate threat intelligence into operations. Threat intelligence should feed directly into vulnerability prioritisation and detection rules, not sit in a weekly report after the threat has materialised. Track adversary TTPs relevant to your industry and geography. Adopt an AI security framework. As your organisation adopts AI, establish security governance early. Align with frameworks like NIST AI RMF and MITRE ATLAS. Conduct AI red teaming, secure applications, and integrate AI threat intelligence. Without proper controls, organisations become low-hanging fruit. Prepare for the quantum transition. Begin with a cryptographic asset inventory to identify use of vulnerable algorithms (RSA, ECC). Develop a PQC migration roadmap aligned with NIST standards (FIPS 203– 205), prioritising long-lived data and critical infrastructure. Ensure cryptographic agility and integrate quantum readiness into your GRC programme in line with NIS2 and the EU Cyber Resilience Act. Measure what matters. Track mean time to detect and patch (especially for internetfacing and critical assets), attack surface growth rate, and the percentage of the estate with continuous monitoring. These metrics show whether the organisation is keeping pace with the threat. Prepare for the AI vulnerability wave. The CSA/SANS briefing urges teams to prepare for a surge of AI-found vulnerabilities by setting up pre-approved change windows, automated testing, and incident response plans that can handle multiple critical patches at once.
20
The path forward What makes our approach different
The convergence of AI-accelerated vulnerability discovery, an industrialised ransomware economy, expanding nationstate activity, and the approaching quantum transition creates a threat environment that periodic, compliance-driven security models cannot address. The data is consistent across every authoritative source: organisations that invest in continuous, intelligence-driven security operations experience materially better outcomes.
Most security assessments start from assets and compliance requirements. We start from real threats. What can actually happen to your organisation, given the adversaries that specifically target your industry and geography? What are the realistic attack paths to your crown jewels? The purpose is real value, not a compliance checkbox. Our HORUS (Hostile Offensive Readiness & Unknown Surface) assessment is designed as a realistic adversary attack simulation tailored to your organisation. Starting from internet, employee, or supplier access points, we combine threat intelligence, attack surface mapping, and targeted penetration testing to produce a provisional root cause analysis and an actionable improvement roadmap.
€1.8M Average savings per breach for organisations with extensive AI and automation in security operations
From there, we build a VulnOps programme that delivers the highest security value for your investment - addressing the specific root causes identified in the assessment, prioritised by real-world threat exposure and potential business impact. The result is a continuous security operation calibrated to maximise ROI by reducing both the probability and cost of incidents.
VulnOps is the operational model that translates this insight into practice. It combines continuous vulnerability management, attack surface management, real-time threat intelligence, and streamlined remediation into a unified discipline that identifies security root causes rather than chasing symptoms. It is how organisations match the speed of modern adversaries and build the resilience that regulations like NIS2 increasingly demand. The question is not whether your organisation needs continuous security operations. The question is whether you can afford to wait. 21
About asUgo Cyber & Privacy asUgo is a leading European consulting firm with offices in Brussels and Lisbon. Our Cyber & Privacy practice is led by practitioners with deep offensive security backgrounds who have conducted penetration tests, red team exercises, incident response operations, and security research (including published CVE discoveries) across critical infrastructure such as financial services, defence, healthcare, and government.
Our team holds OSCP, CISSP, CIPP, CIPM and CISA certifications and brings handson experience in ethical hacking, social engineering, purple teaming, and AI red teaming. We combine this offensive expertise with strategic advisory in governance, risk, and compliance (ISO 27001, NIS2, DORA, GDPR) to deliver security programmes that are both technically rigorous and business-aligned.
Ready to discover your real exposure? Start with a HORUS assessment an adversary simulation to find root causes and build your VulnOps roadmap.
Robin Descamps Head of Cyber & Privacy
r.descamps@asugoconsulting.com +32 476 91 33 11 22
Sources 1. IBM, Cost of a Data Breach Report 2025 2. Verizon, 2025 Data Breach Investigations Report 3. CrowdStrike, 2026 Global Threat Report 4. CrowdStrike, 2025 European Threat Landscape Report 5. Centre for Cybersecurity Belgium, Cyber Threat Landscape 2025 6. Akamai, State of the Internet: Ransomware Trends 2025 7. KPMG, Cybersecurity Considerations 2026 8. CSA CISO Community, SANS, OWASP - The AI Vulnerability Storm: Building a Mythos-ready Security Program (April 2026) 9. Rapid7, Q3 2025 Threat Landscape Report 10. Alice & Bob, Think Inside The Box: Quantum Computing with Cat Qubits (December 2024) 11. Google DeepMind, Towards AGI (April 2025) 12. NIST, Post-Quantum Cryptography Standards: FIPS 203, 204, 205 (August 2024) 13. European Commission, Post-Quantum Cryptography Transition Roadmap (June 2025)
23