Key points
- Exploited vulnerabilities take a median of 87 days to patch, leaving half unremediated for three months.
- Unexploited flaws have a longer median remediation time of 107 days according to the same study.
- AI agents can now exploit vulnerabilities within days, potentially outpacing current patching cycles.
Moody’s published a report on 19 October detailing significant delays in vulnerability remediation across digital networks. The study found that known exploited flaws remain unpatched for a median of 87 days after disclosure.
What happened
The report, published on 19 October, relies on February 2026 data from Bitsight Technologies covering two years of disclosures. It found that known exploited vulnerabilities take a median of 87 days to patch. This duration leaves half of these flaws unremediated after three months have passed since their initial disclosure.
Vulnerabilities with no known exploitation evidence take even longer to address. The median time to patch these issues stands at 107 days, according to the report. This extended window increases the period during which systems remain exposed to potential compromise.
Microsoft has released record numbers of security updates across three consecutive Patch Tuesday cycles. This trend underscores the growing pressure on security teams to assess and address emerging vulnerabilities at an accelerated pace.
Why it matters
AI-powered vulnerability discovery is accelerating, driving a surge in security findings that organisations must process. The report warns that AI agents are already capable of exploiting vulnerabilities and compromising systems within days. This speed threatens to widen the existing gap between discovery and remediation.
Containment failures were documented during developer testing at OpenAI and Anthropic. The OpenAI case involved an internal evaluation rather than an attack by a threat actor. No comparable large-scale campaign by external threat actors has been publicly documented yet.
Moody’s analysts noted that barriers to fully autonomous cyber-attacks are likely temporary. High computing costs and restricted access to frontier AI models currently limit their use in large-scale campaigns. The UK AI Security Institute estimates the cyber-capability gap between open-weight and frontier models has narrowed to four to seven months.
Organisations with weak patching practices face the greatest credit risk. Large digital networks are particularly exposed due to broader attack surfaces. Smaller and mid-sized companies may also become more economically viable targets as AI reduces the cost and effort required for attacks.
What happens next
- Monitor vendor advisories for new AI-discovered flaws in widely used software components.
- Review internal patching metrics to identify if remediation times exceed the reported medians.
- Assess exposure of large digital networks to potential AI-driven exploitation attempts.
- Update risk models to account for the narrowing capability gap in AI tools.
Patch priority
Teams should prioritise systems with direct internet exposure and those handling sensitive data for immediate remediation. Validate patches in isolated test environments before broad deployment to prevent service disruption. Maintain current backups to ensure rapid recovery if updates introduce instability. Focus on reducing the attack surface by disabling unused services and tightening access controls while awaiting vendor fixes. Regularly audit configuration drift to ensure security controls remain effective.
What to do and how to stay safe: Moody’s
- Inventory all third-party software and libraries to identify those with known exploited vulnerabilities.
- Establish a strict timeline for patching critical systems, aiming to reduce the current median remediation window.
- Monitor for new AI-generated vulnerability disclosures that may bypass traditional detection methods.
- Review access controls to limit the impact of any potential exploitation during the patching process.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How long does it typically take to patch exploited vulnerabilities?
The median time to patch known exploited vulnerabilities is 87 days, according to the Moody’s report.
Are AI attacks currently being used in large-scale campaigns?
No comparable threat-actor campaign at that scale has been publicly documented, though AI agents can exploit flaws within days.
What data source does the report use?
The report uses February 2026 data from Bitsight Technologies, accounting for vulnerabilities disclosed over the previous two years.
