The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

Talos Intelligence's Q3 Vulnerability Pulse report highlights that the majority of newly disclosed CVEs are being discovered but not actively exploited, underscoring a shift from pure discovery to selective exploitation in the current threat landscape. For website owners, this means automated AI crawlers and vulnerability‑scanning bots are more likely to probe sites for known weaknesses without necessarily launching attacks, inflating bot traffic and skewing analytics. The rise in reconnaissance activity can trigger false positives in security monitoring and may cause AI‑driven content generators to encounter blocked resources, affecting site performance and SEO. **Actionable tips:** 1. **Update your llms.txt file** to explicitly list reputable vulnerability‑scanner user‑agents (e.g., “QualysGuard”, “Nessus”) with a `Disallow:` rule, while allowing legitimate AI bots like “ChatGPT‑Crawler” to continue indexing. 2. **Implement rate‑limiting** on endpoints commonly targeted by CVE scanners (login pages, API endpoints) and log these requests in your AI bot analytics dashboard to differentiate benign AI traffic from hostile scans. 3. **Deploy a honeypot page** flagged in llms.txt as `Disallow: /vuln-test/` to attract and identify malicious scanners, then feed the captured signatures into your intrusion detection system for proactive blocking.