The risk of AI hacking a company is real, but the bigger problem may be the gap between finding weaknesses and fixing them. Artificial intelligence can uncover vulnerabilities at a scale that security teams struggle to match, while many organizations still rely on manual work to protect their systems.
That gap is showing up in attack data, patching delays, and the shortage of people with cybersecurity expertise. The result is a security race where AI helps defenders and attackers at the same time, but organizations still have to handle much of the work by hand.
AI is finding vulnerabilities at a massive scale
Anthropic’s Mythos model discovered 23,000 cyber vulnerabilities. That figure shows how AI-assisted discovery can expand the number of flaws security teams must review, prioritize, and repair.
Google Threat Intelligence Group reported its first AI-developed zero-day exploit in May 2026. A zero-day exploit targets a weakness before defenders have had time to create and apply a fix, making the development a clear warning that AI-assisted attacks have moved beyond theory.
Still, the flood of discoveries does not mean every vulnerability becomes an active attack. Of 1,061 vulnerabilities attributed to AI-assisted discovery during the first half of 2026, only 14, or 1.3%, have been confirmed exploited in the wild.
That distinction matters. Security teams must separate flaws that pose an immediate danger from the much larger pool that needs review, testing, and eventual remediation. The UK’s National Cyber Security Centre assesses that fully automated, end-to-end attacks remain unlikely before 2027, but organizations already face a serious workload today.
The patching gap keeps growing
Verizon’s 2026 Data Breach Investigations Report attributed 31% of initial access to vulnerability exploitation. At the same time, 51% of surveyed organizations take five or more days to patch critical flaws, or cannot say what their mean time to patch is.
The volume of vulnerability instances has also jumped. Verizon recorded roughly 68.7 million instances in 2022 and 527.3 million in 2025. As the number of weaknesses rises, the systems used to track and fix them must handle far more work without losing sight of the flaws most likely to cause harm.
Progress on known exploited vulnerabilities moved in the wrong direction. Full remediation of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog fell from 38% in 2022 to 26% in 2025, while the median time from detection to full remediation stretched from 32 days to 43 days.
Those figures describe more than a technical problem. A vulnerability can be identified, ranked, and assigned to a team, yet remain exposed for weeks before the repair is complete.
Manual work is limiting the response
Ryan Braunstein, security manager at Automox, put the problem plainly: “Manual work is the new attack surface.” The statement captures why more discoveries do not automatically produce better protection. Every handoff, spreadsheet, approval, and delayed fix creates another place where a known weakness can remain open.
Forty-three percent of teams spend 10 or more hours each week on manual endpoint work, while only 6% are fully automated. Across vulnerability remediation, 62% of organizations still work by hand, 2% are fully automated, and only 9% are confident that important vulnerabilities are fixed on time.
The automation gap is tied to a people gap. Shortages of cybersecurity expertise rank second among barriers to resilience, reaching 57% in the public sector. The shortage affects smaller and larger organizations too: 46% of small organizations and 29% of large organizations report insufficient cybersecurity expertise.
Automation can reduce repetitive work, but it does not remove the need for judgment. Teams still need people who can understand which vulnerability matters most, decide how a repair affects operations, and check whether the fix worked.
Training becomes part of the security strategy
Saint Leo University will require every student, starting in fall 2026, to earn a baseline AI certification and at least two credentials tied to their field. The requirement treats AI knowledge as a basic skill rather than a specialty reserved for technical students.
Dr. Jim Burkee described the approach this way: “We’re pushing forward and doubling down at the same time. We have to prepare our students to use AI and understand the tools – and in the same breath, we’re leaning harder into what’s always mattered: more human, more face-to-face teaching.”
That balance matters in cybersecurity. AI can search for vulnerabilities, sort large volumes of findings, and support repetitive endpoint work, but people still need to guide the process and understand the consequences of each decision.
The central challenge is no longer whether AI can discover security weaknesses. It can. The challenge is whether organizations can combine automation, skilled workers, and timely patching before those weaknesses become an attacker’s opening.
Based on
