When 'Exploitation Unlikely' Stops Meaning Anything: AI Just Broke Vendor Risk Ratings

For years, a small phrase buried in Microsoft's monthly security updates has quietly shaped how thousands of UK businesses schedule their patching. That phrase is 'Exploitation Less Likely'. It sits in the Exploitability Index next to a lot of vulnerabilities, and it has been read by busy IT teams as permission to relax. We'll get to that one next cycle. Nobody says it out loud, but everyone does it.

That shortcut just stopped working.

In late 2024, Anthropic's red team ran an experiment that should make every managed service provider and internal IT lead sit up. They took 14 vulnerabilities that Microsoft had officially rated 'Exploitation Less Likely' and pointed an AI-assisted workflow at them. The team built working exploits for 13 of the 14. Not proof-of-concept hand-waving. Actual, functioning exploit code for vulnerabilities that a vendor had, in effect, told the world were low-priority.

One miss out of fourteen. That is not a rounding error. That is the entire foundation of a widely used risk-triage strategy giving way at once.

What 'Exploitation Less Likely' was actually promising

To understand why this matters, it helps to know what that rating was ever meant to convey. Microsoft's Exploitability Index isn't a measure of how bad a vulnerability is if exploited. It's a prediction about effort and probability — how hard it would be for an attacker to reliably weaponise the flaw, and how likely they were to bother.

The logic was reasonable when it was written. Writing a stable exploit for a memory-corruption bug or a subtle logic flaw used to require a rare mix of skills: deep knowledge of the target, patience, and a tolerance for the exploit crashing the machine ninety times before it worked once. Most attackers didn't have that. So a rating of 'Exploitation Less Likely' was a genuinely useful signal. It let overstretched teams focus their limited patch windows on the flaws that criminals were most likely to turn into real attacks.

The whole model rested on one assumption: that the gap between a vulnerability existing and someone building a reliable exploit for it was wide, expensive, and slow to cross. That gap was the safety margin. It was the reason 'patch it next cycle' felt defensible.

AI has closed the gap.

Why the AI angle changes the maths

The skill that used to be scarce — turning a disclosed vulnerability into working exploit code — is exactly the kind of task large language models have started to handle well. The work is pattern-heavy, documented in public research, and mostly a matter of stitching known techniques together against a specific target. That's a good description of what modern AI is fastest to accelerate.

When the effort required to produce an exploit drops, the probability half of 'Exploitation Less Likely' drops with it. The rating was never a statement about the vulnerability alone. It was a statement about the attacker's economics. Cheapen the attacker's costs and you invalidate the rating without changing a single line of the vulnerable code.

The uncomfortable part for defenders is the direction of travel. Anthropic's red team did this with restraint and disclosure. The people who will do it next are not going to publish a responsible write-up. They're going to run it at scale, against every organisation that assumed a low rating meant a low threat.

The defensive side: Project Perception

Microsoft hasn't been sitting still. Around the same window, it launched Project Perception, its effort to bring AI to the defensive side of vulnerability triage — helping teams understand which flaws in their specific environment actually matter, and prioritising accordingly rather than relying on a static, one-size-fits-all label.

Put the two developments side by side and the message becomes clear. On the offensive side, AI has flattened the effort curve for building exploits. On the defensive side, the same class of technology is being offered as the antidote: continuous, context-aware prioritisation instead of a monthly rating you glance at and act on later.

The old model — static rating, deferred action — is squeezed from both ends. The attackers move faster. The defensive tooling assumes you'll move faster too.

What this means for a UK SME

If you're running a 40-person accountancy firm in the East Midlands, you don't have a red team. You have a couple of IT people, or you have us. Your instinct, quite reasonably, is to keep the business running and patch on a sensible schedule. Emergency changes cost money and cause disruption, so you batch them.

Here's the shift you need to internalise: the vendor's low-priority rating is no longer a reason to defer. It might be a reason to schedule rather than panic, but it is not a licence to wait a month. The assumption that underpinned batching low-severity fixes — that nobody would build an exploit in that window — is the exact assumption that Anthropic dismantled.

This doesn't mean patch everything the moment it drops and accept the chaos. It means changing how you decide.

What to replace 'patch it next cycle' with

A better model has three parts, and none of them require a security operations centre.

1. Prioritise by exposure, not by vendor rating. The question that matters is not how hard is this to exploit in theory but is this thing reachable from the internet, and does it touch data or systems we care about? A flaw on an internet-facing service jumps the queue regardless of what the Exploitability Index says. A flaw on an internal, segmented machine can wait longer. Your own architecture is now a more reliable prioritisation signal than the label on the patch.

2. Shrink your patch windows for exposed systems. For anything facing the outside world, 'next cycle' should mean days, not weeks. Automate where you can. Modern patch-management tooling can stage, test and deploy far faster than a manual monthly ritual, and the disruption is smaller than the ransomware clean-up you're avoiding.

3. Reduce what a single exploit can reach. Since you can no longer trust that low-rated flaws will stay unexploited, assume some will slip through and limit the blast radius. Segment your network. Enforce least-privilege access. Keep clean, tested, offline backups. This is the part that protects you against the vulnerabilities you haven't even heard of yet.

The honest summary

The Exploitability Index isn't useless. It still tells you something about how a given flaw compares to others. But its most important practical function — giving you confidence to defer — has been quietly removed. AI didn't change the code in the vulnerabilities. It changed the person on the other side of them, giving an average attacker the exploit-writing capability that used to belong to specialists.

For UK SMEs, the lesson is not to be frightened. It's to stop outsourcing your patching decisions to a single vendor label that was calibrated for a world that no longer exists. Prioritise by what's exposed, patch your internet-facing systems fast, and make sure that when something does get through, it can't reach everything.

If your current patching schedule still leans on 'low priority means later', it's worth a conversation. We're happy to look at your exposure with you and work out where the genuine risks sit — before someone with an AI assistant does it for you.