AI Is Finding Vulnerabilities Faster Than Security Teams Can Fix Them

Key points

• AI tools now let attackers discover and test exploitable weaknesses far faster than most security teams can respond.
• CrowdStrike CEO George Kurtz told Fal.Con 2026 attendees that AI has become the new battleground for cyber offence and defence alike.
• Security teams already face more alerts than they can realistically act on; AI is widening that gap, not closing it.
• The critical question is no longer "what vulnerabilities do we have?" but "which ones can actually be reached and used against us right now?"

Security teams have always faced a brutal maths problem: too many alerts, not enough hours. AI is about to make that arithmetic worse.

That was the uncomfortable undercurrent at Fal.Con 2026, CrowdStrike's annual security conference. The headline theme was AI reshaping cyber defence. The harder subtext: the same technology is handing attackers a turbocharger.

What did AI change at Fal.Con?

CrowdStrike CEO George Kurtz argued that AI has become the central battlefield. Offence now informs defence in near real time, and organisations need a continuous approach to security, not a yearly checkbox exercise.

The specific worry is speed. AI can scan software for vulnerabilities (weaknesses in code that criminals can exploit) and test whether those weaknesses are actually usable, in a fraction of the time it once took a human researcher. More discovered flaws, faster. For defenders already buried under alerts, every extra flaw on the pile sharpens one question: which one gets fixed first?

We covered the cultural difficulty of moving to continuous security in our 28 August story on why teams are ditching the quarterly scan. Fal.Con suggests the industry hasn't fully made that shift yet.

Why does it matter which vulnerabilities you fix first?

Not every flaw is equally dangerous. A vulnerability buried on a server no attacker can reach matters far less than one sitting on a publicly accessible login page.

What security professionals call "exposure validation" is the practice of checking, concretely, whether a known flaw can actually be exploited in your specific environment. Can stolen credentials be reused to reach other systems? Can two small weaknesses chain into one big breach? Can an attacker move laterally across the network and eventually reach sensitive data?

Answering those questions with real evidence, rather than theoretical risk scores, is what lets a security team prioritise repairs that genuinely reduce danger and skip the ones that sound scary but lead nowhere. Our 11 September story made the same point: scanner reports full of "critical" flags are drowning teams, and most of those flags don't give an attacker a real path in.

Horizon3, a security firm whose research framed some of Fal.Con's discussion (as reported by CSO Online), argues this validation step becomes more critical as AI speeds up the attacker side of the equation.

Should ordinary employees worry about this?

Directly, no. This is largely a concern for IT and security staff inside organisations.

Indirectly, yes. Faster-moving attackers mean breaches that once took weeks could now unfold in days. Customers and employees whose data sits inside those organisations carry the downstream risk.

If you receive an email asking you to reset a password, verify through official channels before clicking anything. Credential theft, where criminals steal login details to access company systems, is one of the specific attack paths exposure validation is designed to uncover before criminals walk through the door.

The tools for attacking are getting sharper, and the argument for checking whether your own defences actually hold up, before someone else does it for you, has never been more straightforward.