AI finds bugs faster, for both sides
Apr 15th, 2026 by Jesper Kråkhede
Something is happening to the number of vulnerabilities. The monthly security updates from the large vendors are getting bigger, and the number of published CVEs in the industry is growing faster than ever. The vendors are open about one of the reasons: AI helps them find bugs in their own code that were missed for years.
That is good news. Every bug found by a defender is a bug that can´t be used by an attacker.
But the same capability exists on the other side. Language models can read code, reason about it and suggest how to trigger a flaw. Researchers have shown that AI can turn a published patch into a working exploit much faster than a human. The window between a patch being released and the vulnerability being exploited, which used to be weeks, is shrinking towards days or hours.
What does that mean technically? Your patch process needs a fast lane. Critical updates for internet facing systems and Tier 0 must be installable within days, sometimes hours, without waiting for the monthly window.
Prioritise on exploitation and exposure, not on the CVSS score alone. A medium bug on an exposed server can matter more than a critical one on an isolated system. Exposure management helps here.
Reduce what you expose, so fewer systems are in the fast lane at all.
And assume that some patches will come too late. Detection and response must catch what the patch didn´t.
The bugs were always there. Now both sides can see them.