Attack Surface Management

A16z, using Epoch.ai data across 21 major software vendors (Apple, AWS, Microsoft, Google, Cisco, Oracle and more), shows critical-severity CVEs that never cleared ~100 a month for four years suddenly jumping past 600 a month since spring 2026; high-severity reports spiked toward ~2,200 a month. In parallel, Kevin Mandia (Mandiant’s founder) says his new venture Armadin has found 90+ zero-days in production at customer sites this year using models post-trained with real red-teamers — black-box, from the internet, no source code. What’s confirmed vs. reported, why the curve bent, and what a security leader should do now.