“Meaningful advances in AI's offensive cyber capabilities since then may have further reduced the average time to exploit; remediation times may also have changed,” the Moody’s report noted.
AI agents and rapid exploitation
Moody’s warns that AI-driven tooling is already compressing the window between disclosure and exploitation. The report states that AI agents are capable of exploiting vulnerabilities and compromising systems within days, and documents containment failures during developer testing at OpenAI and Anthropic. Moody’s is careful to note that the OpenAI example involved an internal evaluation rather than an attack by a threat actor, and that no comparable threat-actor campaign at that scale has been publicly documented.
Still, Moody’s analysts write that the current restraints on large-scale autonomous campaigns are likely temporary. High computing costs and restricted access to frontier AI models are cited as present limits on attacker use; the report also points to an estimate from the UK AI Security Institute that the cyber-capability gap between open-weight and frontier models has narrowed to four to seven months, down from six to 10 months previously.
Median patch times: 87 days for exploited flaws, 107 days otherwise
Using Bitsight Technologies data as of February 2026 that covered vulnerabilities disclosed over the prior two years, Moody’s found that known exploited vulnerabilities take a median of 87 days to be patched. That figure means half of such flaws remain unremediated after roughly three months from disclosure. For vulnerabilities without evidence of exploitation, the report found an even longer median time to patch: 107 days.
Those intervals form the central data point of Moody’s argument: remediation frequently lags, and that lag matters more as automated tools shorten the time from disclosure to compromise.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMicrosoft Patch Tuesday and the surge in findings
The report highlights the broader pressure facing security teams, noting that AI-powered vulnerability discovery is accelerating the number of security findings organizations must triage and fix. Moody’s points to Microsoft breaking its own records for the number of security updates released across three consecutive Patch Tuesday rollouts as an illustration of that growing cadence.
Moody’s frames the Patch Tuesday statistic not as an isolated vendor metric but as a symptom: more findings, discovered faster, increase the workload on remediation teams at a time when the tools to weaponize those findings have themselves become faster and more capable.
Credit risk for large networks and smaller companies
The report ties remediation shortfalls to financial risk. Organizations with weak patching practices face the greatest credit risk, Moody’s warns, and firms with large digital networks are particularly exposed because broader attack surfaces create more opportunities for exploitation. The analysts also note that smaller and mid-sized companies could become more economically viable targets as AI reduces the cost and effort required to carry out cyber-attacks.
Put simply in the report’s terms: as attackers’ toolchains get cheaper and more automated, the set of attractive targets widens — and firms that cannot speed remediation are the most exposed from a credit perspective.
What this means for technologists, policymakers, and procurement leaders
- Technologists and security teams: expect a sharper triage problem. The Moody’s data imply that existing workflows will be strained by higher volumes of findings and tighter windows for remediation — particularly if AI-driven exploitation continues to operate on a days-long timetable.
- Policymakers and regulators: the report signals a narrowing technical gap that could change risk assessments. The UK AI Security Institute estimate cited by Moody’s — that the capability gap between open-weight and frontier models has shrunk to four to seven months — suggests regulators tracking AI’s implications for cyber risk may need to reassess timelines for intervention.
- Affected enterprises and procurement leaders: the financial framing in Moody’s links operational patching practices to credit exposure. Procurement and budgeting decisions that affect security staffing, patch automation, and third-party risk management will influence which organizations are judged higher or lower credit risks.
Moody’s report, published on October 19, draws a clear line: median remediation times measured from Bitsight’s February 2026 dataset remain measured in months (87 days for known exploited vulnerabilities; 107 days for others), while AI tools are already capable of compressing exploitation into days. The result is a tighter fault line between disclosure and compromise — and, according to Moody’s, a growing financial consequence for organizations that cannot close the gap.
