In October, an AI security-testing tool built in China was used to break into South Korean banks, and other breaches hit AI companies and the software they supply. The tool looks at a company's systems, finds a weakness and writes the code to use it, all in one run and with little human help. That changes how fast a company has to install the fixes its software makers publish.
A fix tells attackers where the hole was
When Microsoft or any software maker publishes a fix, it also shows, to anyone who compares the old version with the new one, exactly what was broken. Everyone who has not installed the fix yet is now a known target. Reading that comparison and writing an attack from it used to take a skilled specialist days, which is why a company with a few weeks of delay was usually fine.
AI does the comparison and writes the attack. One security team saw an attacker go from a newly published critical flaw to a working attack in nine hours. The typical company needs 43 days to fix a critical flaw, which is more than 1,000 hours. That is more than a hundred times longer than the attacker needed, and it leaves out the companies that never get round to it.
The pile of fixes is also growing faster than anyone can read it. In October Microsoft published 1,416 security fixes, more than it had published in any previous full year. Part of the reason is that AI now finds bugs for the defenders too. No IT team can check 1,400 items by hand and still finish before the attackers do.
The monthly rhythm itself comes from the slower era. Microsoft made its monthly update day official in October 2003 so that administrators could plan their work ahead. A routine built to give people time to plan assumes the attacker will wait.
What an automatic routine looks like
Take a mid-sized distributor with a twelve-person IT team. Once a month the team reads the update list, tests the updates and schedules a weekend to install them. If that takes two working days a month, the team can get those days back by letting laptops, browsers and office software update themselves the same day. People then check only the order system and the warehouse scanners, because those are the machines where a bad update stops the business. Most of the company's machines go from weeks of exposure to hours, and the team spends its time on the few that need judgment.
The same logic reaches the software a company wrote or bought and customised. AI can scan every program the company owns, fix the bugs it finds and check each fix against tests it writes itself. Work that takes people years takes days, and that is the only pace that matches the attackers.
Some old systems are past fixing. When a scan of an old in-house system turns up 10,000 flaws, rebuilding it from a written description of what it does and a full set of tests now costs less than repairing each flaw. A company that has been putting off replacing its ageing custom system, the one nobody dares touch, has a better argument for doing it than it had a year ago.
What to ask your suppliers
Attackers already run AI over every app a business connects, so a flaw in a supplier's software is a flaw in yours. The question to put to each important software supplier is how soon a fix reaches you after it is published, and whether it installs without anyone having to click.