AI-Powered Attacks: Why Companies Must Overhaul Cybersecurity Now
A McKinsey report warns that AI is shrinking the window to fix software flaws, urging companies to overhaul cybersecurity to survive.
The digital battlefield is shifting rapidly, and the window for defense is slamming shut. According to a recent report by McKinsey, companies must fundamentally overhaul their cybersecurity strategies and ramp up investments in automated threat detection to keep pace with frontier artificial intelligence (AI), which is now making it significantly easier for hackers to identify and exploit software weaknesses.
The Shrinking Window of Defense
The most alarming revelation in the report is the drastic reduction in the time between the discovery of a software flaw and its active exploitation. Just a year ago, organizations typically had a few weeks to patch a critical vulnerability after it was disclosed. Today, that window has shrunk to a matter of hours.
The trend is expected to accelerate further. McKinsey highlights that by 2026, approximately two-thirds of exploited vulnerabilities will be targeted on or even before the day they are officially disclosed.
The Growing 'Remediation Gap'
While attackers are getting faster, the organizations tasked with defending them are slowing down. The report points to a dangerous disparity in response times:
- Attack Speed: Critical vulnerabilities are now exploited within hours of disclosure.
- Defense Speed: Based on an analysis of Verizon's 2026 Data Breach Investigations Report, the median time for organizations to fully remediate vulnerabilities has actually increased from 32 days to 43 days.
- Success Rate: Only 26 per cent of vulnerabilities are being fully remediated.
AI: The Double-Edged Sword
Traditional cybersecurity practices are no longer sufficient because advanced AI models can scan for software weaknesses at an unprecedented scale and speed. The report cites Anthropic's Project Glasswing as a prime example. Partners using the Claude Mythos Preview identified over 10,000 high- or critical-severity vulnerabilities, with some reporting a tenfold increase in their ability to find bugs.
Beyond Just 'More Staff' and 'More Patches'
McKinsey warns that simply hiring more security personnel or increasing the frequency of patching is not a viable solution. Instead, the report argues that "speed by itself is not enough." Companies need a holistic transformation across four key pillars:
- Cybersecurity Practices: Moving toward continuous security monitoring.
- Operating Models: Integrating automated discovery with human oversight.
- Risk and Control Frameworks: Implementing stronger controls over AI-powered systems.
- Technology: Investing in automated prioritization and containment tools.
Strategic Recommendations for Businesses
To build true digital resilience, the report suggests that organizations implement a new security framework over an initial 90-day period, focusing first on critical systems. Key recommendations include:
- Establishing clear accountability for software vulnerabilities.
- Strengthening identity and access controls to prevent unauthorized entry.
- Conducting regular monitoring of third-party suppliers.
- Adopting secure development practices from the start of the software lifecycle.
"At a time when flaws are being found and risk is being weaponized at unprecedented levels, that kind of digital resilience could prove to be a long-term competitive advantage," the report stated.