Security AffairsPierluigi Paganini
ENISA Warns Frontier AI Could Enable “Negative Time-to-Exploit”
ENISA says frontier AI is compressing the cyberattack lifecycle, allowing systems to automate reconnaissance, vulnerability discovery, exploitation, lateral movement and data theft. In its July 2026 paper, *ENISA’s view on Cybersecurity in the Frontier AI Era*, the agency warns that attackers may obtain usable exploit information before defenders have received or deployed a fix, a situation it calls “negative time-to-exploit”.
The article says vulnerability weaponisation may occur within 15 minutes of disclosure, while research cited by ENISA puts the median time from initial access to data exfiltration at 72 minutes. These figures describe potential attack speeds, not evidence that every vulnerability is being exploited at those rates.
The report also highlights a sharp increase in vulnerability reporting: one organisation reportedly rose from roughly 80 CVEs in the first quarter of 2025 to almost 500 in the first quarter of 2026, then reached about 500 reports a day when frontier-AI tools were used. ENISA says this shifts the bottleneck towards verification, prioritisation and remediation, while AI-generated submissions are also placing pressure on open-source reporting pipelines.
It recommends using EPSS and VEX, continuous threat modelling and testing, AI-assisted incident response with human oversight, and an “assume-breached” security model. Organisations should assess whether their operations can detect and respond within minutes, improve asset visibility and reduce approval delays, while treating automated patching cautiously because AI-generated fixes still require verification.
ENISA further calls for “Cybersecurity as Code”, common European benchmarks for testing advanced AI in cyber ranges, and carefully governed sharing of cybersecurity data. It says NIS2, the Cyber Resilience Act and the AI Act provide parts of the policy framework, but Europe needs to develop its capability more quickly as attacks and defensive decisions increasingly occur at machine speed.