There's a lot of noise about AI in cybersecurity right now. AI-powered attacks, AI-powered defence, autonomous security agents. Most of it is marketing.
But there is one change worth paying attention to.
The number of disclosed vulnerabilities is exploding. And the time between disclosure and exploitation is getting shorter.
Google's Threat Intelligence Group reported that monthly vulnerability disclosures more than doubled between January and August 2026. High-risk disclosures are growing even faster.
AI is helping researchers find vulnerabilities that might previously have gone unnoticed. That's a good thing. More vulnerabilities identified, more fixes released.
But there's a catch.
The patch is also a roadmap
When a vendor releases a security patch, they're effectively publishing the difference between vulnerable and fixed code.
Attackers have been reverse-engineering patches for decades. It's called patch diffing. Find what changed, work backwards to understand the vulnerability, then build an exploit against systems that haven't updated.
AI is making that process much faster and more accessible.
What previously required considerable expertise and time can increasingly be automated. Feed an AI system the differences between two software versions and ask it to identify the security flaw.
Suddenly, a vulnerability that might have taken weeks to weaponise can become exploitable much sooner.
We're not necessarily seeing an explosion in zero-day attacks. We're seeing the rapid weaponisation of N-day vulnerabilities.
A zero-day is exploited before a fix is available. An N-day is already known, with a patch available, but the target hasn't installed it.
And that's the problem.
More disclosures. More opportunities.
The irony is that better vulnerability discovery and faster disclosure can also give attackers more opportunities to target organisations that are slow to patch.
And we don't need to look far for an example.
In October 2026, two critical vulnerabilities in PHP, dubbed PHP2Shell, were publicly disclosed.
Cloudflare reported tens of thousands of exploitation attempts within 45 minutes of disclosure. Within two hours, that had grown to hundreds of thousands. By the following day, millions.
Attackers were already probing the vulnerabilities before the patches were released, following an early leak of technical details.
This wasn't necessarily AI-driven patch diffing, and attempts don't automatically mean successful compromises. But it demonstrates just how quickly attackers can move once vulnerability information becomes available.
That's not your next monthly patching cycle. That's barely enough time to finish your morning coffee.
Your old patch management plan probably isn't good enough
Most organisations still operate on patching schedules designed around monthly maintenance windows, lengthy testing cycles and carefully planned outages.
That approach is becoming increasingly difficult to defend, particularly for critical or internet-facing systems.
When exploitation starts within hours of disclosure, a policy that gives you 14 or 30 days to deploy a critical security patch isn't much use.
And there's another consequence we don't talk about enough.
We're going to see more unplanned downtime.
Not necessarily because systems have been compromised, but because organisations are going to find themselves making difficult decisions between keeping vulnerable systems online and taking them offline until they can be safely patched.
For critical systems, that's a serious operational problem.
If your business can't tolerate a few hours of downtime to address a critical vulnerability, what happens when the alternative is leaving a known, exploitable weakness exposed to the internet?
Your patch and vulnerability management processes need to account for this. So do your business continuity plans.
That means knowing what you're running, understanding your exposure, having realistic emergency patching procedures and being prepared to isolate systems when a fix can't be deployed immediately.
And, importantly, designing systems that can actually be patched without bringing the whole business down.
The fundamentals haven't changed
Patch your systems.
Prioritise what's exposed. Have a plan for critical vulnerabilities that doesn't depend on waiting for the next scheduled maintenance window.
AI isn't changing the fundamentals of cybersecurity. It's compressing the time you've got to get them right.
The patch is available. The attackers know what it fixes. Do you really want to be the last one installing it?
CySura | Practical cybersecurity, without the theatre.
Further reading: