Defenders losing the patch race to AI, research finds
2026-11-11
Computing
The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Research from Azul's 2026 AI Vulnerability Gap Report reveals that 85% of organizations running Java have experienced security incidents or near misses due to slow patching, as AI-equipped attackers rapidly exploit new vulnerabilities. The accelerated attack pace enabled by AI has outstripped traditional enterprise defense processes.[AI generated]
Why's our monitor labelling this an incident or hazard?
The article explicitly states that attackers use AI tools to accelerate their hacking attempts, leading to incidents or near misses due to slow patching. This means AI systems are involved in the use phase, facilitating attacks that cause or nearly cause harm to organizations' IT infrastructure. The research data shows that these AI-accelerated attacks have already resulted in incidents or near misses, indicating realized harm or significant risk. Hence, this qualifies as an AI Incident because the AI system's use has directly or indirectly led to harm or near harm.[AI generated]