Artificial intelligence could increase the financial risks facing organisations already struggling to address known software vulnerabilities, as new analysis highlights the growing imbalance between cyberattack capabilities and corporate defences.

AI-driven cyberattacks could increase the financial risks facing organisations with inadequate security measures, according to new research from Moody’s Ratings.

In an analysis published on October 19, the credit ratings agency warned that increasingly sophisticated AI tools could make cyberattacks faster, more automated and more persistent, placing additional pressure on conventional security measures.

The warning comes as existing vulnerability management practices are already struggling to keep pace with the speed at which software flaws can be discovered and exploited.

Earlier research published by Moody’s in March found that known exploited vulnerabilities remained externally observable on organisations’ networks for a median of 87 days, equivalent to almost three months.

The analysis, which drew on data from cybersecurity analytics firm Bitsight covering more than 9,000 Moody’s-rated organisations, also found that vulnerabilities not included in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalogue took a median of 107 days to disappear from externally observable networks.

Vulnerabilities associated with ransomware attacks were addressed more quickly, with a median remediation period of 59 days.

These findings suggest that organisations are prioritising flaws with demonstrated evidence of exploitation, but are nevertheless leaving potentially serious weaknesses exposed for extended periods.

Moody’s analysis also cited research from Flashpoint showing that the average time between public vulnerability disclosure and first observed exploitation fell from 115 days in 2024 to 44 days in 2025.

Although these figures measure different aspects of vulnerability management, they illustrate the increasing pressure on security teams to identify, prioritise and resolve software weaknesses.

AI Adds to Mounting Cybersecurity Pressures

The emergence of more capable AI systems threatens to complicate these challenges further.

AI-assisted tools can analyse extensive codebases, identify previously undiscovered vulnerabilities and help researchers develop and validate potential exploits with significantly less manual intervention.

While these capabilities offer considerable benefits for defensive cybersecurity, they also create opportunities for malicious actors to accelerate their operations.

In its October analysis, Moody’s warned that conventional cybersecurity defences designed around human attackers may prove insufficient against increasingly automated threats.

The agency has also highlighted reports of AI agents operating beyond their intended environments during cybersecurity testing, raising questions about the effectiveness of existing safeguards as autonomous systems become more capable.

Meanwhile, AI-powered vulnerability discovery is adding to the volume of security findings that organisations must investigate and address.

Recommended reading

• East Lothian Council Backs Hyperscale Data Centre Plan at Cockenzie
• Scottish Parliament Votes to Pause All AI Data Centre Applications
• Data Centres “Shredding” Scotland’s Net Zero Goals, Say Campaigners
• US AI Firm Invests £1.15BN in Scottish Data Centre
• Plans Revealed for £15Bn Data Centre Network Across Scotland
  

Moody’s earlier research identified a related challenge involving low-quality AI-generated vulnerability reports, which can divert security teams’ attention from genuine threats and consume resources that could otherwise be dedicated to remediation.

The agency argued that stronger security practices during software development could help reduce the number of vulnerabilities reaching production environments.

Embedding security checks earlier in the development process, supported by AI-assisted code analysis, could also reduce the pressure on teams responsible for patching vulnerabilities after software has been deployed.

With AI capabilities continuing to advance, the findings underscore the importance of strengthening cyber resilience and reducing the time organisations remain exposed to known security weaknesses.