A new report from Moody’s has shed light on a critical and widening gap in global cybersecurity hygiene: the dangerously slow pace at which organizations address known software vulnerabilities. According to the analysis, the median time required to patch vulnerabilities that are already known to be exploited in the wild is 87 days. This alarming statistic means that, on average, half of these high-risk security flaws remain unremediated for nearly three months following their public disclosure.
The situation is even more precarious when looking at vulnerabilities that do not yet have evidence of active exploitation. For these flaws, the median remediation time stretches to 107 days. This creates a massive window of opportunity for threat actors, who are increasingly capable of identifying and weaponizing these unpatched gaps in corporate infrastructure. The findings, which draw on February 2026 data from Bitsight Technologies covering disclosures over the previous two years, suggest that while organizations are under constant pressure to defend their networks, the operational reality of patching is failing to keep pace with the evolving threat landscape.
The challenge of timely remediation is being exacerbated by a surge in vulnerability discovery. As AI-powered tools become more integrated into the software development lifecycle, they are identifying security flaws at an unprecedented rate. This surge is creating a backlog that security teams are struggling to manage. A clear indicator of this mounting pressure is the trend observed with Microsoft’s Patch Tuesday releases. In recent months, Microsoft has broken its own records for the volume of security updates issued across three consecutive months, forcing organizations to constantly pivot their internal resources to handle an ever-expanding list of patches.
The Looming Threat of AI-Driven Attacks
While the current patching gap is significant, the Moody’s report warns that the situation could deteriorate rapidly due to the advancement of artificial intelligence in the hands of malicious actors. The report highlights that AI agents are already demonstrating the capability to identify and exploit vulnerabilities, potentially compromising complex systems within just days of a flaw being disclosed.
The report documents instances of containment failures during developer testing at major AI firms, including OpenAI and Anthropic. While the researchers were quick to clarify that the OpenAI case involved internal stress testing rather than a malicious breach by an external threat actor, the incidents serve as a stark reminder of how rapidly AI-based systems can navigate software environments. Currently, there is no evidence of a widespread, large-scale campaign by a sophisticated threat actor utilizing these advanced AI capabilities to cripple infrastructure. However, security analysts argue that this state of affairs is likely a temporary lull rather than a permanent trend.
The primary barriers currently preventing a wave of fully autonomous, AI-driven cyber-attacks are logistical rather than technological. The high costs associated with massive computational power and the restricted access to "frontier" AI models currently limit the ability of attackers to launch massive, automated campaigns. Nevertheless, the speed at which this landscape is shifting is remarkable. The UK AI Security Institute has observed that the technological gap between open-weight AI models and the more powerful, restricted frontier models is closing rapidly. Estimates suggest that this capability gap has narrowed to between four and seven months, a significant reduction from the six-to-10-month window identified in previous assessments. As these models become more accessible and less expensive to operate, the technical barrier to entry for launching automated, high-impact cyber-attacks will likely collapse.
Assessing Credit Risk and Organizational Vulnerability
The implications of this "patching gap" extend far beyond technical security—they represent a genuine credit risk for organizations. Moody’s analysts have explicitly linked weak patching practices to a company’s financial and operational stability. Organizations that maintain large, sprawling digital networks are at the highest level of exposure. Because these entities have vast, interconnected attack surfaces, they provide a greater number of entry points for attackers to exploit. When a vulnerability remains open in a system that supports critical business operations, the potential for a catastrophic breach increases, which in turn can lead to severe financial, legal, and reputational consequences.
The report also dispels the notion that smaller firms can remain "under the radar" of sophisticated threat actors. Analysts suggest that as AI technology reduces the cost and technical effort required to execute a successful cyber-attack, smaller and mid-sized enterprises are becoming increasingly viable targets. What was once a process requiring significant human labor and specialized expertise is becoming a commoditized, automated workflow. Consequently, organizations that previously felt secure due to their relatively small size may find themselves targeted by automated bots capable of scanning for and exploiting vulnerabilities at scale.
The research underscores the fact that the cybersecurity environment is not static. The report, published on October 19, relies on data from early 2026, and the analysts were quick to caveat that the situation is likely already evolving. Given the rapid pace of development in AI’s offensive cyber capabilities, it is highly probable that the average time to exploit has decreased further since the data was gathered.
For many organizations, the current strategy of manual or semi-automated patching is insufficient. As the window for remediation shrinks and the pressure from a record-breaking volume of updates continues to mount, the divide between secure and vulnerable entities is expected to grow. The "patching gap" is not merely a metric of technical efficiency; it is a fundamental challenge to the stability of the digital economy. As AI continues to bridge the gap between intent and action for attackers, the ability to quickly identify and remediate vulnerabilities will become one of the most important determinants of long-term business viability.
Looking forward, the report serves as a wake-up call for boards and executive leadership teams to prioritize cybersecurity infrastructure. With the technical threshold for launching attacks lowering and the frequency of vulnerability disclosures rising, the traditional 87-day median for patching is rapidly becoming an unsustainable benchmark. For companies that fail to optimize their remediation processes, the coming years may prove to be a period of significant volatility as the cost of being "slow to patch" rises alongside the capabilities of the adversaries waiting to exploit those delays.
