AI-Accelerated Vulnerability Discovery Overwhelms Traditional Patching

Rapid7 reported that AI-driven vulnerability discovery and faster attacker operationalization are outpacing traditional patch management, with high and critical vulnerability disclosures rising from 4,268 in Q2 2025 to 8,539 in Q2 2026. Newly exploited vulnerabilities also increased 8% to 40, and 25 of those were so-called "Holy Grail" flaws requiring neither credentials nor user interaction, underscoring how quickly attackers can capitalize on high-impact exposures. The report also linked the pressure to persistent nation-state activity from China, Russia, Iran, and North Korea, alongside continued ransomware operations by groups including Qilin, The Gentlemen, DragonForce, Akira, and LockBit.

Health-ISAC said the problem is especially acute in healthcare, where patching delays are often built into clinical operations because updates may require vendor validation, hospital testing, scheduled downtime, change-control approval, and sometimes regulatory review. Systems such as MRI platforms can remain exposed while those processes play out, giving attackers time to exploit weaknesses that AI helps identify and weaponize faster. Both reports said organizations should move beyond monthly patch cycles and CVSS-only prioritization, and instead focus on reducing reachable, high-impact exposure during the window when patches cannot yet be deployed.