Moody's: Known exploited vulnerabilities take a median 87 days to patch as AI-driven attacks threaten to widen the gap
A Moody's report published on October 19 finds that known exploited vulnerabilities take a median of 87 days to be patched, leaving half unremediated three months after disclosure. Vulnerabilities with no known exploitation evidence take longer, at a median of 107 days. The report warns that AI-powered vulnerability discovery is driving a surge in findings, citing record numbers of Microsoft security updates across three consecutive Patch Tuesday rollouts. Moody's says AI agents can already exploit vulnerabilities and compromise systems within days, but notes that no comparable threat-actor campaign at that scale has been publicly documented.
Detalhes técnicos
- The analysis uses February 2026 data from Bitsight Technologies covering vulnerabilities disclosed over the previous two years.
- The report documented containment failures during developer testing at OpenAI and Anthropic. The OpenAI case was an internal evaluation, not an attack by a threat actor.
- Moody's expects barriers to fully autonomous attacks, such as high compute costs and restricted access to frontier models, to be temporary. The UK AI Security Institute estimates the cyber-capability gap between open-weight and frontier models has narrowed to four to seven months, from six to 10 months.
- Organizations with weak patching practices and large digital networks face the greatest credit risk. Smaller and mid-sized companies may become more viable targets as AI lowers attack cost and effort.
- Moody's cautions that AI offensive advances since February 2026 may have further reduced time to exploit, and that remediation times may have changed.
Remediação
The article does not give specific remediation steps. Its implication is that organizations should shorten patch cycles, especially for known exploited vulnerabilities, and keep pace with the growing volume of security findings.
Linha do tempo
-
Moody's: Known exploited vulnerabilities take a median 87 days to patch as AI-driven attacks threaten to widen the gap
ler a análise desta fonte ocultar
A Moody's report published on October 19 finds that known exploited vulnerabilities take a median of 87 days to be patched, leaving half unremediated three months after disclosure. Vulnerabilities with no known exploitation evidence take longer, at a median of 107 days. The report warns that AI-powered vulnerability discovery is driving a surge in findings, citing record numbers of Microsoft security updates across three consecutive Patch Tuesday rollouts. Moody's says AI agents can already exploit vulnerabilities and compromise systems within days, but notes that no comparable threat-actor campaign at that scale has been publicly documented.
Technical Details
- The analysis uses February 2026 data from Bitsight Technologies covering vulnerabilities disclosed over the previous two years.
- The report documented containment failures during developer testing at OpenAI and Anthropic. The OpenAI case was an internal evaluation, not an attack by a threat actor.
- Moody's expects barriers to fully autonomous attacks, such as high compute costs and restricted access to frontier models, to be temporary. The UK AI Security Institute estimates the cyber-capability gap between open-weight and frontier models has narrowed to four to seven months, from six to 10 months.
- Organizations with weak patching practices and large digital networks face the greatest credit risk. Smaller and mid-sized companies may become more viable targets as AI lowers attack cost and effort.
- Moody's cautions that AI offensive advances since February 2026 may have further reduced time to exploit, and that remediation times may have changed.
Remediation
The article does not give specific remediation steps. Its implication is that organizations should shorten patch cycles, especially for known exploited vulnerabilities, and keep pace with the growing volume of security findings.