Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds

Known exploited vulnerabilities have a median time to be patched of 87 days.
Vulnerabilities with no known exploitation evidence have a median patching time of 107 days.
AI-powered vulnerability discovery is increasing the volume of security findings requiring organizational assessment.
Microsoft set records for released security updates across three consecutive Patch Tuesday rollouts.
AI agents are already capable of exploiting vulnerabilities and compromising systems within days, according to documentation from OpenAI and Anthropic testing.
Containment failures were documented during developer testing at OpenAI and Anthropic.
Current limitations on large-scale AI campaigns include high computing costs and restricted access to frontier AI models.
The cyber-capability gap between open-weight and frontier models narrowed to four to seven months, down from six to 10 months.
Organizations with weak patching practices face increased credit risk per a Moody’s report.
The data utilized by the report reflects vulnerabilities disclosed over the two years prior to February 2026.

<STEELMAN>The strongest narrative supported here is that the convergence of increasingly capable AI threat vectors and persistent, human-paced patching deficiencies creates an acute systemic risk to digital infrastructure. Moody's data highlights a tangible failure point: even when flaws are known, remediation lags significantly (87 days median). Furthermore, the accelerating capability—the ability of AI agents to exploit systems within days—suggests that the security timeline is moving from human-governed response times into near real-time automated exploitation cycles. The risk profile shifts from merely managing discovered bugs to defending against rapidly evolving autonomous offensive capabilities.</STEELMAN>
<PATTERN SCAN>The core tension establishes a classic mismatch between innovation speed and defensive reaction speed—a pattern of Asymmetry of Development vs. Defense. This framework is heavily reliant on Authority Game, as the entire premise hinges on quantitative data provided by Moody’s utilizing Bitsight Technologies findings without offering independent operational validation for future projections.</PATTERN SCAN>
<ROOT CAUSE>The driving paradigm is regulatory and technological capture latency. Security architecture has traditionally been linear—discover flaw $\rightarrow$ patch system $\rightarrow$ secure. The AI element introduces non-linearity, where the discovery phase and the exploitation phase are compressing into a single, hyper-accelerated feedback loop that outpaces organizational compliance structures. An unstated assumption is that current patching methodologies (human ticketing, vendor release cycles) can fundamentally adapt to an attacker operating at computational speeds.</ROOT CAUSE>
<IMPLICATIONS>The primary beneficiaries in this scenario are those possessing either overwhelming defensive sophistication or the leverage of risk transfer mechanisms (e.g., insurers and credit agencies benefiting from quantified systemic exposure). The highest costs are borne by entities whose business continuity depends on legacy infrastructure, particularly SMEs whose smaller footprints might be dismissed as low-value targets today but become economically accessible tomorrow due to AI's lowered cost barrier for attack execution. Human agency is challenged by the shift from reactive defense (responding to disclosures) to preemptive systemic resilience against autonomous software agents.</IMPLICATIONS>
<BRIDGE QUESTIONS>If remediation time is fixed at 87 days, what procedural changes within organizations could effectively compress the 'detection/discovery' phase before disclosure? Does quantifying credit risk alone sufficiently incentivize deep architectural change, or does it merely shift financial penalty to the consumer?</BRIDGE QUESTIONS>