Can You Still Patch Your Way to Safety? Why the Old Playbook Is Breaking Down

Key points

• AI tools can generate a working exploit, meaning a ready-to-use attack built from a software flaw, within roughly a day of a vulnerability being publicly described.
• Traditional patch management, where IT teams test and apply software fixes on a weekly or monthly cycle, assumes attackers need days or weeks to act on new flaws.
• That assumption no longer holds, and the gap between a flaw being announced and criminals using it is shrinking fast.
• Organisations of every size need to rethink how quickly they prioritise and apply fixes.

What is actually changing here?

For years, security teams operated on a simple idea: a software flaw gets disclosed, researchers publish details, attackers slowly figure out how to use it, and IT teams patch before anything bad happens. That window of relative safety is closing.

AI, specifically the large language model, or conversational AI system, now used widely in software development, can read a public description of a vulnerability and produce a working exploit within roughly a day. SecurityWeek flagged this in a recent opinion piece, and it lines up with what several CTI, meaning cyber-threat intelligence, researchers have been observing for months. Our 21 July story "The Patch Race Is Now a Patch Sprint, and Defenders Are Losing" found that vendors' own fix releases are being reverse-engineered within hours, which means the exposure window has already collapsed to a working day on the defender side too.

A single working day is not long. Many organisations patch on a monthly cycle. Some take longer.

Why does this matter for ordinary people?

When a company's software gets attacked through an unpatched flaw, customers and staff bear the consequences, not the IT team.

A hospital running outdated systems could see patient records locked. A retailer could lose payment data. The breach always begins somewhere technical, but it lands on real people.

Defenders are still working at human speed. Attackers using AI tools aren't.

So is patching pointless now?

No. Patching still matters. But patching alone, on a slow schedule, isn't enough protection any more.

Security teams have traditionally sorted flaws by severity scores, queuing the worst ones first. That made sense when attackers needed weeks to build a working exploit. When an AI tool can do it overnight, a flaw that looked medium-priority on Monday could be actively weaponised by Tuesday. Microsoft pressed this point sharply on 23 July, telling administrators to apply fixes within 72 hours, a demand our coverage at the time found security teams considered deeply impractical.

What this points toward is faster patch cycles for internet-facing systems, better monitoring to catch attacks before a patch is available, and a harder look at which systems truly need to be connected to the internet at all.

For anyone running a business, even a small one, the practical question is concrete: check whether your software vendor offers automatic updates. Turn them on if so. If your IT team manages updates manually, ask how long the gap typically is between a patch being released and it being applied. That gap is exactly what attackers are aiming for.

Common questions

Do I need to do anything right now?

If you run automatic updates on your devices and software, you're already doing the most important thing. Manual update schedules deserve scrutiny: ask whether critical fixes get rushed through ahead of the normal cycle.

Is AI making hackers genuinely more dangerous?

Yes, in this specific way. AI doesn't make criminals smarter, but it strips away the technical skill and time that previously slowed them down. A flaw that once required an expert to weaponise can now be turned into an attack much faster, by people with far less expertise.