AI cyber attacks and the shrinking patch window

Microsoft's 2026 Digital Defense Report says the median time from a vulnerability being discovered in the wild to being weaponised "has fallen to well below 24 hours". That line has been quoted everywhere this month as proof that AI cyber attacks have broken patching. They haven't, quite. But they have changed which part of your patching matters, and a small business that still treats "we patch monthly" as a security posture is now working to a timetable attackers stopped keeping a while ago.

This post walks through what four 2026 datasets actually say about AI vulnerability exploitation, where they disagree, and the handful of changes that follow for a UK organisation with no security team.

What the 2026 data says about AI vulnerability exploitation

Start with volume. Google Threat Intelligence Group (GTIG) counted vulnerability disclosures doubling from 5,045 in January 2026 to 10,740 in August. Exploitation rose too: from an average of 10.5 exploited vulnerabilities a month in 2025 to 18 a month in 2026, with 141 disclosed-and-exploited flaws by August against 127 for the whole of 2025.

The interesting part is where that growth came from. Zero-days (bugs exploited before anyone knew about them) only crept up, from 8 a month to 11. GTIG's reading is that the growth "has been concentrated in the rapid weaponization of n-days": bugs that already have a patch and an advisory. Its explanation is that attackers may find it easier to point language models at patch diffs, version changes, advisories and proof-of-concept code than to hunt for brand-new bugs.

That is the mechanism worth understanding. A patch is a map. Compare the fixed version with the old one and the change shows you exactly where the hole was. That comparison used to need a skilled researcher's time for each patch. A model can take a first pass at every patch released that week.

GTIG gives one concrete case. After the BeyondTrust flaw CVE-2026-1731 was disclosed, one threat cluster was exploiting it within four days, and five more joined within seven.

Earlier in the year, GTIG also reported the first zero-day exploit it believes was developed with AI, built by a criminal group planning mass exploitation (GTIG says its own discovery may have stopped that). The same report describes the North Korean group APT45 sending "thousands of repetitive prompts that recursively analyze different CVEs and validate PoC exploits." That's triage at industrial scale.

How fast are vulnerabilities exploited now?

Short answer: for the vulnerabilities that do get exploited, faster than a monthly patch cycle. VulnCheck found the median gap between a CVE's publication and its listing as known-exploited fell from 120 days in 2025 to 80 days in the first half of 2026, and almost a quarter were exploited on or before publication day.

The detail, from VulnCheck's 1H-2026 report: it tracked 495 newly known-exploited vulnerabilities, and 23.43% of them showed exploitation on or before the day the CVE was published. That share was 28.93% in 2025, so the "day zero" slice actually shrank a little.

Recorded Future's H1 2026 review lands in the same place from a different angle. Of the exploited vulnerabilities it tracked, 38% were exploited before, on, or within seven days of NVD disclosure. The median gap was 31 days, while the average was 564, because attackers keep hammering old flaws long after the news cycle moves on.

Hold onto that second number. It matters later.

The other side: most AI-found bugs are never exploited

Here's the part the headlines skip. VulnCheck counted 1,061 vulnerabilities attributed to AI-assisted discovery. Fourteen of them, 1.3%, have been confirmed exploited in the wild, which VulnCheck says "closely aligns" with the exploitation rate across all vulnerabilities in the same period. AI is finding a lot more bugs. It is not finding bugs that attackers are disproportionately using.

GTIG's numbers point the same way at a bigger scale: only 0.23% of all vulnerabilities disclosed in 2026, roughly one in 431, were ever seen exploited. Recorded Future describes attackers as using AI "to augment existing malware and intrusion workflows rather than conduct fully autonomous attacks", and Microsoft's report says the most complex intrusions are still manually driven in most campaigns it sees.

So which is it? Both, and they fit together once you separate two things. AI has massively increased the number of vulnerabilities published. It has also shortened the time between a patch landing and a working exploit for the small set of bugs attackers actually want: remote code execution on something reachable from the internet. GTIG found half of AI-discovered vulnerabilities lead to remote code execution, against 26% across all CVEs, and that edge and security appliances made up 14% of everything exploited this year.

The practical reading: you don't need to fear the 10,000 CVEs a month. You need to be quick about the few dozen that touch your firewall, VPN, mail server or web stack.

What a small UK organisation should change

None of this calls for buying an AI security product. It calls for doing a few unglamorous things faster and more consistently.

Treat 14 days as a ceiling for internet-facing kit

Cyber Essentials already requires critical and high-risk updates, including anything fixing a CVSS v3 score of 7 or above, to be applied within 14 days of release (NCSC requirements v3.3). Under the v3.3 "Danzell" question set, failing either patching question is an automatic fail of the whole self-assessment, which we covered in what changed in Danzell.

Fourteen days was always a maximum. When one BeyondTrust bug had six attack groups on it inside a week, it's the wrong target for anything facing the internet. Patch exposed devices within days of a critical fix, and keep the 14-day window for laptops and internal systems where the scheme sets it.

It's also worth knowing that the Cyber Essentials Plus external scan has no 14-day grace at all: any internet-facing service with a vulnerability scoring 7.0 or more fails (test specification v3.2).

Sort the queue by evidence of exploitation

At 10,740 disclosures a month, nobody reads them all, and you shouldn't try. Check whether a flaw affecting you is on CISA's Known Exploited Vulnerabilities list, and use exploit-likelihood scores rather than raw severity to decide what goes first. EPSS vs CVSS explains how to combine the two without overthinking it.

Get rid of software that will never be patched

Remember Recorded Future's 564-day average. Attackers don't only chase new bugs; they keep exploiting old ones on systems nobody updates. End-of-life software is the extreme case, because no patch is coming however quickly you act, and Cyber Essentials requires it to be removed or cut off from the internet. Why end-of-life software fails Cyber Essentials covers what counts and what to do with the box you can't retire yet.

Check continuously, not once a year

If exploitation can follow a patch within days, an annual assessment tells you about one day in 365. The rest is drift: a new service opened for a supplier, a router firmware nobody updated, a test server left online (why annual pentests miss it). Microsoft makes a similar point in its own report, arguing that security is better measured by time to mitigation than by patch volume.

This is the problem CyberSpec is built for: it scans your internet-facing assets continuously and flags what a Cyber Essentials assessor would likely fail you on, such as end-of-life software and vulnerabilities scoring CVSS 7.0 or higher. It reports readiness; it doesn't certify you. Our Cyber Essentials hub sets out what the scheme checks.

Don't forget the inbox

Speed of exploitation gets the attention, but Microsoft's incident response data, as reported by Help Net Security, shows phishing as the way in for 23% of intrusions, up from 7% a year earlier, with AI helping attackers personalise lures at scale and write fluently in languages they don't speak. Multi-factor authentication on every cloud service that offers it is both the strongest single defence and an automatic-fail question under Cyber Essentials.

A practical checklist

• List every device and service that faces the internet. Firewall, VPN, remote access, mail, websites, anything a supplier asked you to open.
• Turn on automatic updates wherever the vendor supports them.
• For internet-facing kit, apply critical fixes within days, not at the next monthly window. Write that target down.
• Subscribe to security advisories for your firewall and VPN vendor, and check new flaws against CISA's Known Exploited Vulnerabilities list.
• Find and remove or isolate end-of-life software and hardware.
• Switch on MFA for every cloud service that offers it.
• Re-check your external exposure at least monthly, ideally continuously, and track how long fixes take rather than how many you applied.