AI is changing how vulnerabilities are discovered and exploited for defenders and attackers alike, and the practical effect is that the time organizations have between a flaw being found and a flaw being exploited keeps shrinking. Today, we have more known vulnerabilities than at any point in history, and they’re being exploited faster than ever. Nearly 87% of exploited vulnerabilities in 2026 have been exploited before or on the day they were disclosed, up from 48% in 2024 and just 19% in 2018, according to zerodayclock.com, a neutral, independent observatory for cybersecurity telemetry.
More code, more bugs, and AI-aided discovery have all influenced this volume. The systems exposed are often the same systems that run revenue, operations, and customer relationships. Leaders now need to focus on something bigger than prevention alone. They need to build cyber resilience, the ability to withstand an attack, continue operating, and recover quickly. Every organization is racing against the clock to build that resilience.
We saw this play out recently during a week that saw multiple high-profile vulnerabilities and security incidents emerge in rapid succession. PHP2Shell, the name given to two critical remote code execution (RCE) vulnerabilities in PHP, became one of the most visible examples of how quickly newly disclosed flaws can become immediate operational risks. Researchers using frontier AI models identified the flaws and worked with the PHP Foundation to prepare fixes, but details leaked before the planned release. Patches were pushed early, but between the time the vulnerability was disclosed and the patch was available, exploitation attempts began appearing almost immediately. Our Arctic Wolf Labs researchers used aggregated, anonymized telemetry from across our customer community to spot spikes in scanning activity and to analyze exploitation attempts and uncover attacker payloads tied to PHP2Shell. Labs also replicated attacker techniques in controlled environments.
Those findings fed new detections, threat hunt queries, and immediately valuable customer remediation guidance, but detection and response work like this is most effective when an organization already knows what it needs to protect. While PHP2Shell captured much of the industry’s attention, it was only one example in a week that underscored how quickly new exposures can emerge across technologies and attack surfaces. The broader lesson is that organizations need resilience before the next disclosure arrives, and that the time to build cyber resilience into an organization’s ecosystem is now. Jason Clinton, Deputy CISO at Anthropic, warned on X following the PHP2Shell disclosure that security leaders need to prepare their boards as soon as possible for the new threat landscape.
“As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)” — Jason Clinton, Deputy CISO at Anthropic
Organizations best positioned during that window already knew where PHP ran in their environment, which of those systems faced the internet, and how quickly they could patch, restart, and verify each one. A flaw in a system you cannot see cannot be fixed in the hours that matter. Those are the basics boards need to fund. Because the gap between discovery and exploitation will keep shrinking, the organizations that win the race against the clock are the ones that build that foundation of continuous visibility into their attack surface and disciplined exposure management before the next disclosure arrives.
Machine Speed Is the New Normal
AI accelerated both sides of the PHP2Shell situation timeline. The underlying flaws in the code had reportedly been in PHP for years, and turning them into a usable exploit required a level of complexity that would have been extremely difficult and time-consuming for most researchers to achieve on their own. Attackers gain the same AI efficiencies defenders do. They’re using AI to write malware, build exploits, find vulnerabilities, and automate actions. This means the gap between a flaw being disclosed and being exploited will keep narrowing. Patching alone cannot keep pace when that gap is just a few hours long.
In many circumstances, a vulnerability is disclosed before a patch is available. PHP2Shell showed us that. In those moments, security leaders need a way to detect exploit attempts and respond effectively. Machine speed meets that moment, especially when an exposure is widespread, and security leaders should recognize that machine-speed attack and defense are the new normal.
That shift has implications far beyond the security team. Cyber risk now deserves the same level of ownership, accountability, and investment as financial and operational risk. Boards and executive teams need to treat security as a business issue, not just a technical one. That starts with the fundamentals, including maintaining an accurate inventory of assets, applying patches on a defined timeline, enforcing strong identity controls, and maintaining continuous visibility across the environment. These aren’t new security practices, but they become far more important as AI compresses response timelines. You can’t remediate a vulnerability in hours if you don’t know the system exists.
The Four Fundamental Principles of Threat Protection for the AI Era
Vulnerabilities aren’t the only path to a breach. Initial access comes from social engineering (which is scaling with AI), internet-facing misconfigurations, and internet-facing vulnerabilities. Once an attacker is inside, more internal exposure means faster movement. We want to close the opportunity through configuration health and security hygiene.
Security fundamentals only work when teams can operationalize them consistently.
Exposure management strategies turn security hygiene upkeep into a repeatable process. Start with full visibility of your attack surface, including shadow IT and configuration gaps. Then connect asset management with vulnerability and patch management so each cycle improves on the last. Find known and hidden assets, assess them in the context of one another, identify where vulnerabilities are present and controls are missing, and mitigate the highest impact exposures first.
True resilience requires a continuous cycle of risk mitigation over time. Fewer exposures mean fewer opportunities for attackers, and organizations of every size can better defend against AI-driven threats with AI-driven defense and expert oversight. That means operating at machine speed with experts overseeing the work, and it requires knowing your environment, maintaining strong security fundamentals, and responding quickly when new threats emerge. In an era of machine-speed attacks, resilience belongs to organizations that can move just as fast.
Security operations must evolve as well. Human-only processes can’t keep pace with the speed and volume of modern threats. At the same time, fully autonomous security without oversight introduces its own risks. AI should handle most of the volume of investigation that slows down teams, while experienced analysts focus on validation, judgment, and the genuinely complex threats that require context. We’ve built Arctic Wolf around that principle. Our patent-pending Swarm of Experts™ combines specialized AI agents with expert human oversight, allowing us to operate at machine speed. Large teams of AI agents perform investigations, analysis, and response activities at scale, while experienced security experts remain involved where judgment matters most.
Leaders also need to prepare for the reality that one day, their organization may fall victim to AI-driven adversaries, with tested response plans and the ability to restore operations quickly. As the threat landscape rapidly evolves, this scenario appears increasingly likely, especially for businesses that lack the resources to staff their own security team.
We built Arctic Wolf for moments like this one. Internal staffing around the clock is difficult and costly, even for large organizations. Attackers don’t care about holidays, and AI cares even less. That’s why a partner matters. By combining AI-driven automation with expert human oversight, we help customers respond with speed and confidence when new risks emerge. Through our global partner ecosystem, we’re bringing that capability to organizations around the world and helping security leaders turn cyber risk into cyber resilience.
PHP2Shell won’t be the last vulnerability to remind us how quickly the threat landscape can change. This isn’t a risk to sleep on or push to next year’s budget. The time to act is now. The organizations that come through these moments will be the ones that understand their environments, maintain strong security fundamentals, and can respond decisively when new threats emerge. There has never been a better time to get proactive about cyber resilience.
This blog reflects the author’s views as of the publication date and contains forward-looking statements and opinions about technology trends. Actual outcomes may differ based on attacker behavior, customer environments, and broader market and regulatory developments.
