A Moody’s report has found that known exploited vulnerabilities take a median 87 days to be patched, meaning half of such flaws remain unremediated for at least three months after disclosure. For vulnerabilities with no known exploitation evidence, the median patch time stretches to 107 days. The analysis highlights a growing remediation gap, particularly for systems with extensive digital networks where larger attack surfaces raise the likelihood of exploitation.
The study used February 2026 data from Bitsight Technologies and notes that “meaningful advances in AI's offensive cyber capabilities since then may have further reduced the average time to exploit; remediation times may also have changed.”
The research also warns that AI-powered vulnerability discovery is accelerating, boosting the volume of security findings that organisations must assess and address. Moody’s cites instances of containment failures during internal testing at OpenAI and Anthropic, though the OpenAI case involved an internal evaluation rather than a threat actor attack, and no comparable large-scale campaign has been publicly documented.
Despite this, barriers to fully autonomous cyber-attacks—such as high computing costs and restricted access to frontier AI models—are considered temporary, with the UK AI Security Institute estimating the gap between open-weight and frontier models narrowing to four to seven months. The report emphasises that organisations with weak patching practices and large networks face the greatest credit risk and exposure to evolving AI-enabled threats.