AI Is Finding Software Flaws Faster Than Companies Can Fix Them. Something Has to Change.

Key points

• AI tools can now scan software at scale, confirm flaws are exploitable, and hand that intelligence to criminals without a human researcher in the loop.
• Verizon's 2024 Data Breach Investigations Report recorded a median enterprise patch time of 43 days, a figure security experts call dangerously slow.
• Virtual patching blocks attacks at a security layer rather than fixing the broken code underneath: it buys time but does not remove the underlying risk.
• Security leaders say continuous, real-time intelligence about which systems are exposed has to replace the scheduled monthly scan.

For decades, fixing software flaws worked roughly like this. A human researcher found a problem. They reported it. The software maker issued a fix, called a patch. Companies tested the patch and rolled it out. The whole cycle could take a month or more, and that was considered acceptable.

AI has broken that model.

Tools built on large language models, the same technology behind chatbots, can now scan software at enormous scale, find weaknesses, confirm they are exploitable, and hand that intelligence to criminals, all without a person in the loop. Rik Ferguson, vice president of security intelligence at security firm Forescout, put it bluntly in comments first reported by CSO Online: "An AI system doesn't wait for a proof-of-concept to circulate on GitHub or a CVSS score to land in a dashboard. It finds the flaw, confirms exploitability, and moves."

How big is the gap between finding a flaw and fixing it?

Big, and growing. Verizon's 2024 Data Breach Investigations Report put that 43-day median patch time on the record. Against a human attacker, that window was uncomfortable. Against an AI system working through thousands of targets overnight, it becomes a problem of a different order entirely. Our coverage of Microsoft's 622-fix Patch Tuesday on 14 July showed what AI-accelerated discovery looks like when the bill finally arrives.

The UK's National Cyber Security Centre has warned that AI-accelerated discovery will likely drive a surge in newly reported flaws. Andrew Woodford, chief technology officer at network security firm Titania, told CSO Online: "Most organizations already struggle to fix known issues quickly, so a spike in AI-driven discovery could easily overwhelm teams."

Some companies turn to virtual patching as a short-term answer. A virtual patch does not fix the broken code. Instead, it sits in front of the vulnerable system and blocks known attack methods from reaching it: think of it as a bouncer who stops trouble at the door while the building's faulty wiring stays untouched inside.

The risk is that temporary becomes permanent. Ferguson warns that a virtual patch can create "a false sense of closure that delays proper patching indefinitely."

Shane Fry, chief technology officer at RunSafe Security, goes further, arguing in comments to CSO Online that virtual patching "leaves security teams chasing a gap they will never be able to close." His preferred approach removes entire classes of exploits before they can be triggered, which takes pressure off the patching cycle rather than accelerating it.

Ferguson advocates an approach he calls "Assume Autonomy": plan for the possibility that criminals are already using AI to probe your systems, and ask what controls limit the damage they can do once inside. That means knowing every device on your network, mapping which systems face the internet directly, tracking which flaws criminals are actively exploiting right now, and having an emergency process for pushing a fix outside the normal monthly schedule.

Should you worry?

If you run IT for a business, pressure-test your asset inventory. You can't protect a device you don't know exists. If you're a customer or employee, this is why software-update prompts matter and shouldn't be dismissed.