Powerful AI tools have fundamentally altered cyber defense by shrinking the time it takes to exploit a software flaw. What once took skilled hackers days, weeks, or months can now be weaponized in hours or days, making traditional defense and patching strategies obsolete.

As AI models become adept at finding software vulnerabilities, there's a limited time for companies to use these tools defensively. This brief "catch-up" period exists before these powerful capabilities become widely available to malicious actors, creating an urgent, time-boxed need for proactive patching of legacy systems.

The rise of AI-powered attacks means vulnerabilities are exploited in minutes. Palo Alto Networks responded by developing a capability to deliver and deploy patches to all customers in just four hours, a massive reduction from the industry average of 55 days, fundamentally changing incident response time.

Frontier AI models are dramatically reducing the time it takes for a newly discovered software vulnerability to be turned into a functional exploit. This acceleration means traditional, onerous patching cycles are no longer viable. Organizations must find new ways to patch systems almost immediately, as exploits can appear within hours of a vulnerability's announcement.

While AI models find vulnerabilities in open-source code, maintainers lack the capacity to review and accept all AI-generated patches. This creates a dangerous situation where exploits are effectively public on GitHub before a fix is widely available, increasing software supply chain risk for thousands of companies.

Nikesh Arora says models arriving in two to three months will be more capable than public ones, so bugs not found today will be found soon. He warns defenders will lose the luxury of weeks to assess whether a vulnerability is real, because AI also accelerates exploit writing.

Advanced AI models capable of finding complex code vulnerabilities are expected to be publicly available within months. This puts enterprises in an urgent race to find and patch their own security holes before malicious actors use the very same tools to exploit them.

The average time for an enterprise to patch a zero-day vulnerability is 55 days. AI agents can now find and build an attack for that same vulnerability in a fraction of a second, fundamentally changing the speed and scale of cyber defense required.

The traditional cybersecurity model of humans finding and patching vulnerabilities cannot keep pace with AI that discovers thousands of exploits in hours. This fundamental mismatch in speed and scale will require a complete overhaul of how software security is managed.