The vulnerability crisis: How AI is shrinking the window for defense | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

The vulnerability crisis: How AI is shrinking the window for defense

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

"Microsoft Patch Tuesday, exploit Wednesday" used to be a joke. Now it's reality. Adversaries use LLM disassemblers to reverse-engineer patches, identify underlying flaws, develop exploits, and begin scanning the internet for targets — all within a day of publication. Five months ago that window was four days.

James Blake is Global Head of Cyber Resiliency Strategy at Cohesity.

The problem isn’t new attack methods. It’s patching speed. Very few organizations can patch in a day. CISA gives even the most critical US organizations 30 days to patch internet-facing vulnerabilities. If you have Fortinet, Ivanti, Cisco, or Microsoft infrastructure facing the internet, the question is not whether you will be hit, but when.

The reason organizations need resilience is that protection has failed. Not occasionally — routinely. Security teams' instinct is to respond with more protection: better EDR, more threat intelligence, faster patching cycles. All of that is necessary, but none of it is sufficient.

Across every incident my team has responded to, all the companies whose data was encrypted had an up-to-date EDR solution in place. It didn't matter.

AI tools have made vulnerability exploitation faster and easier

Patch window is officially dead as AI finds bugs faster than humans can squash them

Claude Mythos turns years of security research into 20-hour AI exploits

There are at least eight known methods for evading EDR tools. The most common involves deploying a vulnerable kernel module via an initial exploit that sits above the firmware, where detection capabilities are effectively blind. This is the standard playbook, not an edge case.

Threat intelligence has the same structural problem. By definition, intelligence about adversary behavior lags behind that behavior. Even threat intelligence-led patching strategies — where organizations prioritize vulnerabilities based on known exploitation activity — have a built-in delay. The intelligence arrives after the window has already opened.

AI is also accelerating attacks in the phishing space, though in a different way. AI can analyze how individuals construct their emails and generate impersonations convincing enough to fool colleagues.

Business email compromise attacks that once required significant skill and access can now be assembled quickly and at scale. Adversaries were always doing this. AI just lowered the barrier considerably.

Companies need to embrace an unsettling truth: Attacks are going to land no matter how exceptional the security team is. Some CISOs still believe otherwise. They will tell their board that given enough budget and headcount, the company can be protected. But breaches at even the largest, best-funded organizations show that assumption is not grounded in reality.

How AI is outpacing cybersecurity and what firms must do next

What the Open Claw vulnerability reveals about the future of agentic AI security

81% of teams ship broken code: Mythos made that inexcusable

Most security leaders still avoid having that conversation with the business. They should be leading with it. AI isn’t introducing fundamentally new attack techniques. It’s accelerating ones adversaries were already using. And if protection was already failing before AI, the case for building genuine resilience is stronger than ever.

Mature security planning starts not with how to prevent every attack but with accepting that some will inevitably succeed. That shifts the discussion from an unrealistic hope of closing all vulnerabilities to how to continue operating when an attack succeeds.

Map your most critical business services and the infrastructure behind them. Most organizations find gaps they didn't know existed.

Check whether your network configurations are backed up. Most organizations don't.

Simulate losing Active Directory and corporate email simultaneously. What surfaces will tell you more about your resilience posture than any audit.

Whether an exploit takes four days to develop or one, the resilience strategy is the same: identify the most essential services before a crisis hits, maintain them under duress, and rebuild trust at every level — network, identity, access — before declaring the environment safe.

When vulnerabilities are exploited in hours, not days, security stops being about prevention alone. It becomes about how quickly an organization can operate through failure. In a world of “exploit Wednesday,” resilience—not speed—determines who stays operational.

We've featured the best endpoint protection software.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

James Blake is Global Head of Cyber Resiliency Strategy at Cohesity.

You must confirm your public display name before commenting

1 Amazon reveals £1bn investment in the UK - 4,000 jobs set to be created, with new £500m fulfilment centre hoping to speed up deliveries across the country

2I let Chat GPT roast me, and it's clearly been trained well on insults

311 world-class projectors to scale up your World Cup viewing

4I‘ve had some awesome mobile mice in my time, but I can’t wait to travel with the Logitech Mobi Fold

5 Report warns 'potentially lethal' knock-off phone chargers sold online could risk exploding

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards