Lord of the Controls, Part 3: Into the Mines of Moria

Part 3 of 5 in the Lord of the Controls series. [Read Part 1: Leaving the Shire of Static PDFs and Part 2: The Council of Rivendell and the Pass of CR26.] 

The dwarves of Moria dug too greedily and too deep, and they woke something in the dark. Attackers are digging now too. Only they aren’t using pickaxes. They’re using AI. 

Every Fellowship eventually meets a monster that can’t be beaten by throwing paperwork at it. In modern security, that monster is vulnerability overload at machine speed. And FedRAMP’s new vulnerability rules just changed how the fight works. 

The Balrog Doesn’t Wait for Your Grace Period      

The numbers from 2026 threat research are hard to ignore: 

The average eCrime breakout time dropped to 29 minutes, and the fastest observed was 27 seconds (CrowdStrike 2026 Global Threat Report). 

Operations by AI-enabled adversaries rose 89% year over year (CrowdStrike). 

42% of vulnerabilities were exploited before public disclosure (CrowdStrike). 

Mandiant estimates the mean time to exploit is now negative seven days, which means exploitation routinely starts before a patch exists (M-Trends 2026). 

Attackers have automated discovery, scanning, and exploitation. Cloud environments change faster than anyone can track. Meanwhile, most compliance programs still run on spreadsheets. That cadence mismatch is where teams lose the race against risk. 

So, let’s say the quiet part out loud. The 30/60/90-day grace period is dead. It was designed for an adversary who read the advisory, waited for a maintenance window, and took a few weeks to build an exploit. That adversary has retired. The one that replaced it doesn’t sleep, doesn’t read your SLA, and doesn’t care that row 4,212 of your remediation tracker says “in progress.” 

Managing a vulnerability list by hand against an AI-assisted attacker is like fighting a Balrog with a clipboard. You will not pass. 

FedRAMP Agrees: The Spreadsheet Shall Not Pass   

FedRAMP’s new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules become mandatory for all offerings on December 7, 2026, aligned with CISA BOD 26-04. FedRAMP’s own notice states that “the legacy monthly vulnerability scanning process… is insufficient.” 

One new rule deserves a place on every CISO’s wall: “Assume It’s Automatable.” Unless you have evidence otherwise, you must assume an exploit can be automated. That is FedRAMP acknowledging the world AI-enabled attackers have built. 

Notice what this does to the old model. If every exploit is presumed automatable, a fixed calendar can’t be your prioritization strategy. Severity labels alone can’t be either. You need to know which vulnerabilities are reachable, which are being exploited right now, and how fast that changes. 

You can’t run that inside a Green Dragon portal, and you can’t run it inside a Scroll-Scribe’s text editor. 

Seeing in the Dark     

The palantíri were seeing-stones: tools that let their holders watch the enemy’s movements across Middle-earth in real time. In the wrong hands, they were deadly. Saruman looked into one and was slowly mastered by it, shown only what the enemy wanted him to see. Aragorn took up the same stone, bent it to his will, and used what it showed him to turn the war. 

Automation in the VDR/VER fight is a palantír. It can show you exactly where the enemy is moving, or it can bury you in noise until you stop thinking for yourself. RegScale is built to put the stone in your hands: 

See where the enemy is actually moving. Raw scanner scores show you everything and tell you nothing. For supported scanner integrations, RegScale brings in internet exposure and known-exploitation data, including CISA Known Exploited Vulnerabilities (KEV) due dates, for FedRAMP VDR evaluation. You see the threats that can hurt you, not a wall of alerts. 

Priorities that follow the battlefield. Findings are evaluated against internet reachability and known-exploitation status, so high-impact, exposed threats rise to the top instead of sitting in a severity-sorted queue. 

Vision wired into where the work happens. The RegScale CLI passes known-exploitation and reachability data into FedRAMP VDR evaluation, so the stone sees what your scanners see, as they see it. 

The stone advises; the king decides. RegML AI agents can read an issue and draft a corrective action plan, with suggested owners and due dates, for your team to review and approve. Speed comes from the machine. Judgment stays with people. 

Machine-speed attacks require machine-speed defense. But the stone was never the problem. Saruman and Aragorn held the very same one. The difference was who stayed in command. RegScale gives you the speed of the machine, and a human always holds the stone.  

Fly, You Fools     

Gandalf’s last advice in Moria wasn’t “write a better policy document.” It was move. 

The attackers have already moved. The rules have moved. The only question is whether your vulnerability program moves at their speed or at the speed of a monthly spreadsheet review. 

Next: Part 4, The Fires of Mount Doom. Where we finally throw the Ring of Manual Paperwork into the fire and replace it with honest, real-time evaluation and living resilience.