The fundamental race between security teams and malicious actors has reached a critical inflection point, as a new report from Moody’s sheds light on a widening gap in vulnerability management. Despite the increasing frequency and sophistication of cyber-attacks, organizations are struggling to keep pace with the basic necessity of patching known vulnerabilities. According to the report, which draws upon data provided by Bitsight Technologies, the median time required to remediate vulnerabilities currently sits at levels that leave companies dangerously exposed to exploitation.
For vulnerabilities that have been confirmed as "known exploited"—meaning threat actors are actively leveraging them in the wild—the median time to reach a patched state is 87 days. This sobering statistic implies that for a significant portion of the global digital infrastructure, half of these critical security flaws remain unremediated for nearly three months following their public disclosure. This window of opportunity, which extends well beyond what most security frameworks consider acceptable for critical infrastructure, represents a massive opening for attackers looking to infiltrate corporate networks.
The situation is arguably even more concerning when considering vulnerabilities that do not yet have evidence of active exploitation. For these flaws, the median time to patch stretches to 107 days. While security teams often prioritize vulnerabilities based on known exploitation, this delay creates a "pre-exploitation" window that is increasingly being weaponized by sophisticated attackers who can identify and reverse-engineer these flaws before a patch is ever applied.
The Rising Tide of Vulnerability Disclosure
This struggle to patch is occurring against a backdrop of unprecedented acceleration in vulnerability discovery, driven largely by the integration of artificial intelligence into software development and security research. As AI tools become more adept at identifying code defects, the volume of reported security findings is surging. Organizations are no longer just fighting against a static set of bugs; they are managing an exponentially growing queue of vulnerabilities that require triage, assessment, and remediation.
The pressure on IT and security departments is perhaps best illustrated by the recent performance of major software vendors. Microsoft, a bellwether for the broader software industry, recently shattered its own records for the volume of security updates released during consecutive Patch Tuesday cycles. These record-breaking rollouts underscore the unsustainable pressure placed on security teams, who are often tasked with testing and deploying patches for a vast array of systems within environments that are increasingly complex and interconnected. As the volume of patches grows, the human and technical resources required to verify these updates without disrupting business operations become a bottleneck, further extending the time to remediation.
AI-Driven Attacks Threaten to Widen the Patching Gap
The urgency of the patching crisis is compounded by the evolving nature of the threat landscape. The Moody’s report warns that the same AI technologies currently being used to discover vulnerabilities are also being harnessed to create more effective, autonomous, and rapid exploitation tools. AI agents have already demonstrated the capability to identify, analyze, and exploit vulnerabilities within a matter of days—a timeline that dwarfs the current 87-day industry standard for remediation.
The report highlights notable instances of containment failures during internal testing at high-profile AI organizations like OpenAI and Anthropic. While the report is careful to clarify that these incidents were contained within developer environments and were not the result of malicious external campaigns, they serve as a proof-of-concept for the potential speed of AI-driven exploits. To date, there has been no publicly documented large-scale campaign by a threat actor utilizing these advanced AI capabilities, but analysts suggest that this is likely a temporary reprieve.
The barriers currently preventing a surge in fully autonomous, AI-driven cyber-attacks are primarily economic and structural rather than technical. The high costs associated with massive-scale computing power and the restricted access to "frontier" AI models have historically limited their use to well-resourced state actors or highly sophisticated criminal syndicates. However, these barriers are rapidly eroding. The UK AI Security Institute has observed that the capability gap between open-weight models—which are more accessible—and the most advanced frontier models is closing. Estimates suggest this gap has narrowed from a range of six to 10 months down to just four to seven months, signaling that the democratization of powerful offensive AI tools is imminent.
Credit Risk and the Economic Impact of Insecurity
For financial analysts and risk assessors, these security trends are no longer just an IT concern; they are a significant credit risk. Moody’s emphasizes that organizations with weak patching practices are particularly vulnerable, as their failure to manage basic security hygiene reflects broader deficiencies in operational risk management.
Large-scale digital networks are at the highest risk, as their expansive attack surfaces offer a multitude of entry points for attackers. However, the report also notes a shift in the target profile of cybercriminals. As AI reduces the cost and technical effort required to launch sophisticated attacks, mid-sized and smaller companies—which may have previously been overlooked due to limited return on investment—are becoming increasingly viable targets. The automation of the exploitation process means that attackers can now afford to pursue smaller targets with the same level of efficacy as large enterprises.
The data underpinning these findings, which covers the two-year period leading up to February 2026, offers a sobering baseline for the current state of digital security. Moody’s analysts point out that since the data was gathered, there have been meaningful advances in AI’s offensive capabilities. It is highly probable that the average time required to successfully exploit a vulnerability has decreased, while the time required for companies to remediate them has remained stagnant or improved only marginally.
As the industry moves forward, the disconnect between the speed of automated discovery and the manual pace of human-led patching remains the central challenge of the modern cybersecurity era. Organizations that fail to accelerate their vulnerability management life cycles risk finding themselves on the wrong side of a widening chasm, where the ability to detect and fix flaws is perpetually outstripped by the ability of AI to weaponize them. The mandate for security leaders is clear: without a fundamental shift toward automated, risk-based, and rapid remediation, the window of exposure will only continue to shrink, leaving even the most prepared organizations increasingly susceptible to the next generation of automated threats.
