From Months to Minutes: How AI Is Forcing Companies to Rethink Software Security
Criminals once needed two years to turn a software flaw into a working attack. By next year, that window is expected to shrink to four hours. Companies that patch on a quarterly schedule are already behind.
Key points
- In 2018, attackers took an average of 771 days to weaponise a known software flaw; by 2026 that figure is projected to fall to roughly four hours.
- AI tools are letting criminals scan for weaknesses, build attack code, and launch intrusions at a speed that traditional quarterly patching cannot match.
- Security experts now recommend continuous scanning and risk assessment, replacing the old habit of checking once or twice a year.
- Companies that cannot patch fast enough can still reduce their exposure by tightening other controls, including real-time monitoring and threat intelligence programmes.
- Customers whose data sits inside affected applications face rising risk if their providers are not adapting their security practices now.
Not long ago, a criminal who discovered a flaw in a company's software needed, on average, more than two years to turn that flaw into a working attack. That gave IT teams a long runway to patch, test, and move on. That runway is gone.
By 2026, the same process is expected to take around four hours. AI tools, which can automatically scan thousands of systems and write attack code without human help, are the main driver. The gap between "flaw discovered" and "flaw exploited" has collapsed.
Why can't companies just patch faster?
Patching, which means applying a software update that fixes a security weakness, takes time even in well-run organisations. Code must be tested before it goes live; systems must be taken offline briefly; teams need to co-ordinate across departments. Four hours is not a realistic patching window for any large company.
The honest answer is that patching alone can no longer be the primary defence. Companies need a broader set of habits running in parallel.
What should companies actually be doing?
Several practical steps can reduce risk even when patches are not yet applied.
First, know what you have. A company cannot protect software it does not know is running. Maintaining an up-to-date list of every application, every programming interface (an API, meaning a connection point that lets different pieces of software talk to each other), and every AI component is the foundation everything else rests on.
Second, scan constantly. Vulnerability scanning, which means running automated checks that look for known weaknesses across company systems, used to happen quarterly. Given current attack speeds, it needs to run far more frequently, producing a near-real-time picture of what is exposed.
| Practice | Old standard | New recommendation |
|---|---|---|
| Risk assessment | Annually or quarterly | Continuous |
| Vulnerability scanning | Quarterly | Near-continuous |
| Patching cycle | Months | As fast as possible; hours where critical |
| Threat intelligence | Ad hoc | Formal, ongoing programme |
Third, tighten preventive controls. Firewalls, access restrictions, and login rules that block suspicious behaviour can slow an attacker down even when the underlying flaw has not been patched. These are the "other levers" security teams can pull when patching is not yet possible.
Fourth, add runtime security, meaning software that watches an application while it is actually running and raises an alert if something unusual happens. This is increasingly important as AI components, including large language models (LLMs, the technology behind tools like ChatGPT), become part of company products.
Should ordinary customers be worried?
Yes, in a practical sense. If a company holding your personal data, medical records, or payment details is still running on a quarterly security review schedule, its exposure is growing every week. That is worth knowing.
If you receive an unexpected email asking you to confirm account details after a service you use announces a breach, treat it as suspicious. Criminals often follow breaches with phishing emails, where they send fake messages designed to trick you into handing over passwords or personal information. Contact the company directly through its official website rather than clicking any link in the email.
