Moody's: Known exploited vulnerabilities stay exposed a median 87 days as AI raises attack risk
Moody's Ratings published an analysis on October 19 warning that AI-driven cyberattacks could raise financial risk for organisations with weak security, because AI tools make attacks faster, more automated and more persistent. Earlier Moody's research from March, using Bitsight data on more than 9,000 Moody's-rated organisations, found that known exploited vulnerabilities stayed externally observable for a median of 87 days. Vulnerabilities not in the CISA Known Exploited Vulnerabilities (KEV) catalogue took a median of 107 days to disappear, while ransomware-linked flaws were fixed faster, at a median of 59 days. Flashpoint research cited by Moody's shows the average time from public disclosure to first observed exploitation fell from 115 days in 2024 to 44 days in 2025. Moody's also noted that low-quality AI-generated vulnerability reports burden security teams and divert resources from genuine threats.
Detalhes técnicos
- Median external exposure of known exploited vulnerabilities: 87 days.
- Median exposure of vulnerabilities not in CISA KEV: 107 days.
- Median remediation time for ransomware-associated vulnerabilities: 59 days.
- Disclosure-to-first-exploitation window (Flashpoint): 115 days (2024) versus 44 days (2025).
- AI-assisted tools can analyse large codebases, find undiscovered vulnerabilities and help develop and validate exploits with less manual effort.
- Moody's also highlighted reports of AI agents operating beyond their intended environments during security testing.
Remediação
- Shorten the time to patch known exploited vulnerabilities, prioritising CISA KEV entries and flaws linked to ransomware.
- Embed security checks earlier in the development process, supported by AI-assisted code analysis, to reduce vulnerabilities reaching production.
- Prepare for automated threats, since defences designed around human attackers may prove insufficient.
Linha do tempo
-
Moody's: Known exploited vulnerabilities stay exposed a median 87 days as AI raises attack risk
ler a análise desta fonte ocultar
Moody's Ratings published an analysis on October 19 warning that AI-driven cyberattacks could raise financial risk for organisations with weak security, because AI tools make attacks faster, more automated and more persistent. Earlier Moody's research from March, using Bitsight data on more than 9,000 Moody's-rated organisations, found that known exploited vulnerabilities stayed externally observable for a median of 87 days. Vulnerabilities not in the CISA Known Exploited Vulnerabilities (KEV) catalogue took a median of 107 days to disappear, while ransomware-linked flaws were fixed faster, at a median of 59 days. Flashpoint research cited by Moody's shows the average time from public disclosure to first observed exploitation fell from 115 days in 2024 to 44 days in 2025. Moody's also noted that low-quality AI-generated vulnerability reports burden security teams and divert resources from genuine threats.
Technical Details
- Median external exposure of known exploited vulnerabilities: 87 days.
- Median exposure of vulnerabilities not in CISA KEV: 107 days.
- Median remediation time for ransomware-associated vulnerabilities: 59 days.
- Disclosure-to-first-exploitation window (Flashpoint): 115 days (2024) versus 44 days (2025).
- AI-assisted tools can analyse large codebases, find undiscovered vulnerabilities and help develop and validate exploits with less manual effort.
- Moody's also highlighted reports of AI agents operating beyond their intended environments during security testing.
Remediation
- Shorten the time to patch known exploited vulnerabilities, prioritising CISA KEV entries and flaws linked to ransomware.
- Embed security checks earlier in the development process, supported by AI-assisted code analysis, to reduce vulnerabilities reaching production.
- Prepare for automated threats, since defences designed around human attackers may prove insufficient.