The AI-driven surge in vulnerability discovery and exploitation has begun. Three indicators from the past few weeks:
1. chatter that incident response firms are fully booked and overwhelmed with business (meaning breaches are happening even if we don’t see headlines)
2. a major certificate authority compromise (eMudhra)
3. the massive PHP vulnerabilities discussed today (CVE-2026-109618 and CVE-2026-109619)
AI is either directly discovering the vulnerabilities or is a means to rapidly exploit the issue at scale and low cost. The combination of low cost and scale means industries that skated under the radar because of attacker interest / ROI are now squarely in the attack crosshairs.
This applies to all companies, big and small. You are not safe because “hackers won’t come after industry XYZ”. They will.
The defensive needs are clear. We need to migrate from human-driven cyber defense to defense at the speed of computers. This is the position I laid out in December when I spoke to the House Homeland Security Committee subcommittee in DC about the threat of AI-powered cybersecurity attacks.
What should organizations do today?
This is not an exercise in being clever. Rather the need is to be comprehensive.
1. Understand your exposure - Establish an automated inventory of your packages, libraries, operating systems, full tech stack, etc.
2. Understand when you need to respond - Build automated monitoring systems that monitor public CVEs and cybersecurity chatter and cross-reference this with your inventory. Response time is moving from days to hours to minutes. You need automation and alerting.
3. Mobilize and plan for response - The issue will inevitably hit at 2am. How will you mobilize the right team members? Can you bring the system offline in moments (operationally, and do you have internal authorization)? What team members are needed? Do you have reliable paging and response? Practice now.
4. Reduce Attack Surface & fix issues you can now - AI chaining is increasingly tying together otherwise low-risk issues into critical outcomes. This means you either need to comprehensively analyze all known vulns to better understand if a low is actually a high risk issue. Or, lacking this capability, be more aggressive to fix known issues. One simple way to fix issues - remove the access and exposure. A device that can’t be reached is much harder to exploit!
This is not business as usual. Your cybersecurity posture and strategy over the next 18 months are an opportunity to survive when your competition fails (and they may no longer be a competitor at that point).
If you’ve been saying “We take cybersecurity seriously...” This is your chance to put your money where your mouth is.