Companies need to overhaul cybersecurity as AI accelerates vulnerability attacks: Report

Companies will need to fundamentally overhaul their cybersecurity strategies and increase investments in automated threat detection and vulnerability management as frontier artificial intelligence (AI) makes it easier for cyberattackers to identify and exploit software weaknesses, according to a McKinsey report.

The firm warned that the shrinking time between vulnerability disclosure and active exploitation could leave organisations increasingly exposed unless they adopt continuous security monitoring, faster remediation and stronger controls over AI-powered systems.

"Attackers are moving faster, with the average time between the disclosure of a critical vulnerability and active exploitation now just a matter of hours, compared to a few weeks as recently as a year ago," the report said.


McKinsey highlighted that by 2026, around two-thirds of exploited vulnerabilities were being exploited on or before the day of disclosure. In contrast, the median time taken by organisations to fully remediate vulnerabilities increased from 32 days to 43 days, with only 26 per cent of vulnerabilities fully remediated, based on Verizon's 2026 Data Breach Investigations Report analysis.

The report said traditional cybersecurity practices were becoming inadequate as advanced AI models could identify software vulnerabilities at unprecedented speed and scale.

It cited findings from Anthropic's Project Glasswing, whose partners identified more than 10,000 high- or critical-severity vulnerabilities using Claude Mythos Preview, with some reporting that their bug-finding rates had increased more than tenfold.

McKinsey said organisations would need to simultaneously strengthen four areas -- cybersecurity practices, operating models, risk and control frameworks, and technology -- rather than relying solely on hiring additional security personnel or increasing patching efforts.

"Speed by itself is not enough to handle the job," the report said, emphasising the need for an integrated security programme that combines automated discovery, prioritisation and containment with human oversight.

It also recommended that companies establish clear accountability for software vulnerabilities, strengthen identity and access controls, regularly monitor third-party suppliers and introduce secure development practices.

The report suggested organisations begin implementing the new security framework over an initial 90-day period, starting with critical systems and expanding based on measurable improvements.

"At a time when flaws are being found and risk is being weaponized at unprecedented levels, that kind of digital resilience could prove to be a long-term competitive advantage," the report said.