AI Is Finding Vulnerabilities Faster Than Security Teams Can Fix Them

Key points

• AI tools now let attackers discover and test exploitable weaknesses far faster than most security teams can respond.
• CrowdStrike CEO George Kurtz told Fal.Con 2026 attendees that AI has become the new battleground for cyber offence and defence alike.
• Security teams already face more alerts than they can realistically act on; AI is widening that gap, not closing it.
• The critical question is no longer "what vulnerabilities do we have?" but "which ones can actually be reached and used against us right now?"

Security teams have always faced a brutal maths problem. Too many alerts. Too many software flaws. Not enough hours. AI is about to make that arithmetic significantly worse.

That was the uncomfortable undercurrent at Fal.Con 2026, CrowdStrike's annual security conference held earlier this year. The headline theme was how artificial intelligence is reshaping cyber defence. The subtext was harder to ignore: the same technology is handing attackers a turbocharger.

What did AI change at Fal.Con?

CrowdStrike CEO George Kurtz argued that AI has become the central battlefield. Offence is now informing defence in near real time, and organisations need a continuous approach to security, not a yearly checkbox exercise.

The specific worry is speed. AI can scan software for vulnerabilities (weaknesses in code that criminals can exploit) and test whether those weaknesses are actually usable, in a fraction of the time it once took a human researcher. That means more discovered flaws, faster. For defenders already buried under alerts, every extra flaw on the pile raises the same urgent question: which one should we fix first?

Why does it matter which vulnerabilities you fix first?

Not every flaw is equally dangerous. A vulnerability buried on a server no attacker can reach matters far less than one sitting on a publicly accessible login page.

What security professionals call "exposure validation" is the practice of checking, concretely and in your own environment, whether a known flaw can actually be exploited. Can stolen passwords be reused to access other systems? Can two small weaknesses be chained together into one big breach? Can an attacker move from one part of the network to another, a technique known as "lateral movement", and eventually reach sensitive data?

Answering those questions with real evidence, rather than theoretical risk scores, is what lets a security team prioritise repairs that genuinely reduce danger, and skip the ones that sound scary but lead nowhere.

Horizon3, a security firm whose research framed some of Fal.Con's discussion (as reported by CSO Online), argues this validation step becomes more critical as AI speeds up the attacker side of the equation.

Should ordinary employees worry about this?

Directly, no. This is largely a concern for the IT and security staff inside organisations.

Indirectly, yes, because faster-moving attackers mean breaches that once took weeks to execute could now unfold in days. Customers, patients, and employees whose data sits inside those organisations carry the downstream risk.

If you receive an email asking you to reset a password, verify through official channels before clicking anything. Credential theft, where criminals steal login details to access company systems, is one of the specific attack paths that exposure validation is designed to uncover before criminals walk through the door.

The tools for attacking are getting sharper. The case for checking whether your own defences actually hold up, before someone else does it for you, has never been more straightforward.