What Boards Must Demand in the Age of AI-Automated Exploitation

This article argues that AI-accelerated exploitation has fundamentally changed the risk calculus for vulnerability backlogs, and demands stronger board-level governance of cybersecurity.

• •Threat actors now use agentic AI to accelerate reconnaissance, exploit development, and operational tempo, collapsing the cost and skill barrier for exploitation.
• •Anthropic publicly disclosed disrupting a cyber-espionage campaign where attackers used Claude to materially increase their speed and scale.
• •Boards cannot delegate governance to CISOs alone; Delaware's Caremark doctrine requires boards to actively engage with reported risks, including large CVE backlogs.
• •Key questions boards should demand answers to include: total open Criticals/Highs, mean time to remediate, 0-day response readiness, and dollar cost of the backlog.