AI accelerates cyberattack speed forcing a shift in corporate security

The shrinking window for defense

Cybersecurity is entering a new era where the speed of attack is outpacing human response times. According to a report by economictimes.indiatimes.com, frontier artificial intelligence is making it significantly easier for bad actors to find and use software weaknesses. This shift is creating a dangerous gap between when a flaw is discovered and when it is actively exploited by hackers.

The data shows a dramatic acceleration in this timeline. Just one year ago, it took several weeks for attackers to begin exploiting a newly disclosed critical vulnerability. Now, that window has shrunk to a matter of hours. This rapid escalation means that the time available for IT teams to react and secure their systems is disappearing almost instantly.

The consequences of this speed are already becoming visible in industry data. McKinsey noted that by 2026, approximately two-thirds of exploited vulnerabilities will be targeted on or before the day they are publicly disclosed. This creates a high-pressure environment where companies are often defenseless the moment a bug becomes public knowledge.

AI as a tool for vulnerability discovery

The primary driver of this change is the ability of advanced AI models to scan software at an unprecedented scale. Rather than relying on manual testing, attackers can use automated tools to identify flaws across massive codebases simultaneously. This capability allows for a level of thoroughness and speed that was previously impossible for human researchers alone.

Specific examples of this technology in action have already emerged from the research community. Findings from Anthropic's Project Glasswing showed that partners used the Claude Mythos Preview to identify more than 10,000 high- or critical-severity vulnerabilities. In some instances, these partners reported that their rates for finding bugs increased by more than tenfold when using AI assistance.

While these tools are being used for research and bug hunting, they are also the same types of models that cybercriminals can leverage. As AI becomes more proficient at identifying these

The growing gap in remediation

Current data suggests that organizations are struggling to keep pace with the evolving threat landscape. According to an analysis of Verizon's 2026 Data Breach Investigations Report, the median time for companies to fully fix vulnerabilities has actually increased from 32 days to 43 days. This trend indicates that defensive measures are falling behind the speed of modern cyberattacks.

The problem is further complicated by the fact that only 26 per cent of vulnerabilities are being fully remediated. This low completion rate suggests that many systems remain partially exposed, leaving a significant amount of "technical debt" that attackers can continue to exploit over time.

Moving beyond simple speed

McKinsey argues that simply trying to move faster is not a sufficient solution on its own. The report emphasizes that companies need an integrated security program that balances high-tech automation with human judgment. This approach must combine automated discovery, prioritization, and containment with active human oversight to be effective.

Relying solely on hiring more staff or increasing manual patching efforts is no longer considered a viable standalone strategy. Instead, organizations must strengthen four specific areas: their cybersecurity practices, operating models, risk and control frameworks, and their underlying technology to create a cohesive defense.

A roadmap for digital resilience

To address these challenges, the report suggests a structured transition toward a new security framework. Organizations are encouraged to begin this implementation over an initial 90-day period. This phased approach allows companies to stabilize their defenses without disrupting core business operations.

The rollout should prioritize the most critical systems first, with further expansion occurring based on measurable improvements. By establishing clear accountability for software flaws and monitoring third-party suppliers, companies can build a level of digital resilience that serves as a long-term competitive advantage.