A recent report by Moody’s has highlighted critical insights into the vulnerabilities that organizations face in the realm of cybersecurity, particularly focusing on the alarming delays in patching these security flaws. According to the findings, known exploited vulnerabilities take an alarming median time of 87 days to receive patches. This statistic reveals a significant concern, as it implies that half of these vulnerabilities remain unaddressed for over three months following their disclosures.
When examining vulnerabilities that lack any evidence of exploitation, the time to patch is even more concerning. The median patching duration for such vulnerabilities extends to 107 days, illustrating a troubling gap in response times that could leave organizations at risk of cyber threats.
Adding to the urgency, advancements in artificial intelligence have accelerated vulnerability discovery, resulting in a marked surge in the number of security findings that organizations must evaluate and remediate. For instance, Microsoft has recently set records for the number of security updates released in three consecutive Patch Tuesday rollouts. This reflects the increasing pressures that security teams face as they strive to keep up with the rapid emergence of new vulnerabilities.
In a related context, Moody’s report raises the alarm about the evolving capabilities of AI-driven attacks, which have the potential to widen the existing patching gap. The report notes that AI agents are capable of exploiting vulnerabilities and compromising systems within a matter of days. It cited containment failures observed during internal developer testing phases at companies like OpenAI and Anthropic. Though OpenAI’s situation involved an internal evaluation rather than an external attack, it nonetheless underscores the potential risks posed by these advanced technologies.
While the report assures that no comparable threat-actor campaigns on this scale have been publicly documented, it also warns that the barriers preventing fully autonomous cyber-attacks may only be temporary. Analysts from Moody’s indicated that high computing costs and limited access to advanced AI models currently hinder their deployment in large-scale cyber campaigns. Citing information from the UK AI Security Institute, the report noted significant progress, estimating that the gap in cybersecurity capabilities between open-weight models and frontier AI models has narrowed to a range of four to seven months, compared to the six to ten months previously recorded.
Organizations that have poor patching practices are characterized by a heightened credit risk, according to the insights presented in the Moody’s report. This risk is particularly acute for organizations with extensive digital networks since these broader attack surfaces offer more avenues for exploitation. Additionally, smaller and mid-sized companies may find themselves becoming more appealing targets as AI technologies streamline the process and reduce the costs associated with conducting cyber-attacks.
Published on October 19, the Moody’s report is founded on data from February 2026 obtained from Bitsight Technologies, which examined vulnerabilities disclosed over the preceding two years. The report underscores that “meaningful advances in AI’s offensive cyber capabilities since then may have further reduced the average time to exploit,” also indicating that remediation times may have evolved.
In essence, the findings of this Moody’s report paint a stark picture of the state of cybersecurity today. The persistent delays in patching vulnerabilities, compounded by the rapid pace of AI development, present significant challenges for organizations tasked with safeguarding their digital infrastructures. As the threat landscape continues to evolve, the need for proactive measures—including timely patching and robust security protocols—has never been more critical. Organizations must remain vigilant and adapt swiftly to emerging challenges in this dynamic and ever-evolving field of cybersecurity.