AI cyberattack capabilities double every four to five months, matching the pace of programming evolution as defenders' "patch windows" close to zero.
Author: Matt Bornstein (Partner at a16z)
Compiled by: TechFlow
TechFlow Preview: For over two decades, the global cybersecurity defense ecosystem has rested on an unspoken time-lag assumption: transforming a newly disclosed system vulnerability into a highly reliable exploit typically requires top-tier human hackers to spend weeks or even months. Defenders have relied on this fragile "patching window" to sustain the day-to-day functioning of the digital world.
However, in its latest in-depth research report, Silicon Valley's top venture capital firm a16z points out, based on 23 years of offensive and defensive historical data, that the underlying bottleneck supporting the entire internet security architecture has been completely shattered by AI. Today, the ability of large models to autonomously generate attack code doubles every four to five months, already catching up with the evolutionary pace of code generation itself. The time required to weaponize a known vulnerability has been compressed to minutes or hours, while the patching cycle for global critical infrastructure remains stuck at 30 to 45 days, or even years without a fix.
Although a16z believes that physically isolated national power grids and core backbone networks with robust redundancy will not be paralyzed instantly, this undoubtedly marks the definitive end of the era where "being too small makes you immune to attacks." As the marginal cost of attacks approaches zero, millions of SMEs, local hospitals, and water systems will face indiscriminate plunder. Understanding this asymmetrical shift in productive forces is crucial for every technology executive and investor.
On the last day of August, a single operator deployed hundreds of AI agents simultaneously targeting a print management server widely used by schools and enterprises globally.
Within an extremely short timeframe, these agents autonomously built a testing lab, wrote exploit code on the spot for two security vulnerabilities disclosed just four days prior, pulled target lists from internet scanning services, and launched a full-scale attack.
From a blank workspace to breaching the internal network of the first real victim institution, the entire process took less than four hours.
When the attack campaign fully unfolded the next morning, 11 institutions fell within just 26 seconds. By the time cybersecurity monitoring firm GreyNoise completed its tally, 395 institutions across 48 countries had been compromised, half of which were schools. The model executing this attack was merely an inexpensive open-source weight model, certainly not a frontier flagship large model from top U.S. labs. These agents even ignored the operator's preset instruction to "avoid 28 specific countries" during the assault.
Seven weeks later, two extremely severe critical vulnerabilities in PHP—a programming language powering 70% of the world's websites—leaked accidentally before official patches were released.
Four days before the vulnerability went public, and 12 hours before the official patch launch, Amazon's honey pot servers designed to trap attackers were already hit by exploitation attempts. Within the following three days, attackers produced fully functional interactive remote control terminals (Shells).
AWS Chief Information Security Officer (CISO) CJ Moses explicitly stated regarding this: AI is "drastically reducing the cost of turning patch diffs or vulnerability advisories into usable attack tools," and "the industry-standard seven- or thirty-day Service Level Agreements (SLAs) for security response were essentially built on a time-lag assumption that no longer exists."
Inside a16z, these real-world offensive and defensive incidents sparked intense debate. One camp argues we are entering a terrible decade: agents will indiscriminately breach all unpatched targets within hours of disclosure, sweeping across power grids, water systems, and hospital networks that take months or even years to patch.
The opposing camp holds familiar historical memories: the birth of Metasploit in 2003 promised to arm amateur novices worldwide with cyber weapons; the advent of the Shodan search engine in 2009 was thought to expose every industrial controller and IoT device on Earth. Yet neither event ultimately ended the internet's operation.
Core Assessment: The Reality and Boundaries of Offensive-Defensive Imbalance
For the past twenty years, the core bottleneck of offensive cybersecurity has always been the expert skills and protracted time required to transform a known vulnerability into a highly reliable, weaponized exploit.
However, in 2025 and 2026, this work has become unusually cheap and rapid, with the required time plummeting from days or months to mere minutes or hours. Conversely, patching speeds on the defensive side have not accelerated at all, and for massive systems globally (especially critical infrastructure vital to national economies and livelihoods), physical constraints make faster patching fundamentally impossible.
This does not mean we are sliding toward a comprehensive, ultimate catastrophe. We firmly believe that national power grids will not suddenly plunge into darkness, nor will the entire internet suffer total collapse.
The realistic scenario we anticipate involves a wave of widespread outbreaks similar to the 2003 worm era and the 2017 WannaCry ransomware storm. This wave will fall heaviest on legacy systems unable to update/patch quickly, and on a few exceptionally high-value targets where a single breach yields billions in illicit profits.
Exploits are the only phase we can precisely quantify and statistically analyze over the past 23 years, so our research data entry point here. But it must be recognized that a skilled human hacker's time cost permeates every link in the attack chain.
Reconnaissance of network topology, tailoring attack payloads to a target's unique hardware/software environment, lateral movement within intranets, and final monetization: every step previously required dedicated human operators, and hackers' time was only justified when invested in targets offering substantial returns. This was the true meaning of the old adage "too small to target." Small institutions, while unable to escape mass automated botnet scans, never needed to fear targeted strikes from high-level human hackers, as deploying specialized manpower simply wasn't worth it.
Today, AI is slashing the cost across every link in this entire attack chain, far beyond just generating exploit code. This explains why the two most destructive malicious incidents this autumn didn't even require entirely new zero-day vulnerabilities: the attack on chilled storage systems across hundreds of European supermarkets merely exploited outdated industrial controllers that hadn't received firmware updates for ages, with vulnerability details public for months; and the staggering $63 billion heist at Binance was accomplished simply by compromising a single engineer's personal computer.
Figure: Evolution of the time window from vulnerability disclosure to actual exploitation, 2018–2026
Data from cybersecurity giant Mandiant shows that the average interval between a security vulnerability's public disclosure and the first appearance of real-world attacks dropped sharply from 63 days in 2018–2019, to 44 days in 2020–2021, 32 days in 2021–2022, and a mere 5 days in 2023.
By 2024, real-world exploitation actually averaged one day ahead of the official public disclosure; by 2025, this window evolved into an average of seven days before disclosure when wild exploits were first observed.
A crucial contextual point must be noted: the crossover reversal of these two timelines actually occurred prior to the full-blown emergence of autonomous Agentic AI. National-level hacking organizations and top-tier ransomware criminal syndicates had already learned to conduct precision strikes against exposed internet-facing devices well before official patches were released.
The truly disruptive variable AI brings lies in how it completely restructures who has the capability to operate within this narrow window, and accelerates the weaponization speed of already-known legacy vulnerabilities (N-days) to terrifying scales.
Historical Context: Why Exploitation Was the Greatest Bottleneck
An exploit is essentially a computer program that converts a vulnerability flaw in code or logic into system access privileges. For two decades, building such a program was an incredibly expensive and highly time-consuming craft.
A classic RAND Corporation study from 2017, examining over 200 real zero-day vulnerabilities, found that the median time for a professional top-tier hacker to build a stable, usable exploit was 22 days. Middlemen on black markets priced each usable exploit between tens of thousands and millions of dollars, and this core R&D skill was historically almost entirely monopolized by national intelligence agencies and a handful of massively funded transnational cybercrime groups.
This insurmountable technical barrier perfectly explains one of the most frequently cited counterintuitive statistics in vulnerability management: of all known public vulnerabilities in human history, only about 6% were ultimately weaponized by hackers in the wild and successfully attacked. Timothée Chauvin, an analyst at Epoch Research Group, attributes most of this massive gap to past attackers "simply not having enough time to write attack tools for every single vulnerability."
This also explains why the open-source penetration testing framework Metasploit did not destroy the internet back then. Metasploit indeed made it extremely easy to run others' pre-written attack code, but at the cutting edge, top-tier experts still had to manually write the code, manually lock onto targets, and personally orchestrate the attacks. Today, AI agents are taking over all of those steps.
In that historical era, defensive capabilities also saw leapfrog upgrades. Microsoft once boldly paused all development of new Windows features for two entire months, shifting the entire workforce to security hardening, and subsequently released Windows XP Service Pack 2 with the system firewall enabled by default and strengthened patch controls.
Cybercrime gradually professionalized, prompting hackers to favor maintaining stealthy access for steady, long-term monetization; Metasploit itself evolved into a core tool for defenders conducting security self-audits and red/blue team exercises. These two balancing forces remain critically important today. But the fundamental difference is: back then, Microsoft could single-handedly force-update operating systems on the vast majority of computers globally; today, the massive number of internet-facing systems are distributed across tens of thousands of vendors and millions of devices that have long been abandoned.
A more apt historical parallel is the moment an originally scarce attack tool suddenly became free to the masses: EternalBlue. Microsoft released a fix for this vulnerability in March 2017; a month later, the elite weapon-grade exploit code crafted by the U.S. National Security Agency (NSA) specifically for this flaw was stolen and leaked.
Fifty-nine days after the official patch had been publicly available, the notorious WannaCry ransomware worm emerged, instantly paralyzing 81 of England's 236 National Health Service trust hospitals. The subsequent NotPetya attack caused devastating economic losses exceeding $100 billion. What's worth pondering is that every victim institution actually had a full two months to patch up before the disaster struck.
Before that was the global worm era spanning 1999 to 2004. According to historical calculations cited by cybersecurity expert Jason Healey, if converted to 2025 U.S. dollars, those massive outbreaks caused direct economic losses exceeding $250 billion. It wasn't until Microsoft initiated historic security reconstruction that this calamity was finally contained.
The Real Battlefield: Frontline Shifts in Cyberspace in 2026
Although frontline combat records since 2026 cover a relatively short period, every case is highly indicative and deeply warning.
On September 21, an AI agent successfully breached the defenses of the Dutch Institute for Vulnerability Disclosure (DIVD) by chaining two zero-day vulnerabilities within a ticketing customer service software. As the institute marveled in its official post-mortem, the entire intranet privilege escalation "was completed within seconds," and the entire process involved the agent "fully autonomously making the next tactical decisions."
Earlier this May, Google's Threat Intelligence Team disclosed its first observation of a wild-zero-day exploit developed by criminals using AI, a tool originally intended for large-scale automated cyberattacks, fortunately intercepted before deployment. In August, the NSA, CISA, FBI, DOE, and EPA jointly issued an emergency security alert, warning that hackers are using AI-generated scripts to conduct wide-ranging reconnaissance and attacks against Siemens industrial controllers exposed to the public internet in energy, water, and chemical plants. The alert made no mention of any brand-new vulnerabilities; the sole change highlighted was that those old, publicly known security flaws now possess full automation capabilities for attacks.
Additionally, industrial cybersecurity giant Dragos disclosed and documented a severe intrusion: an attacker used a frontier large model as their "Chief Technology Officer," autonomously writing over 17,000 lines of code for a customized attack framework, pushing relentlessly into the office intranet and industrial control system perimeter of a Mexican water utility company, only being arduously halted by the defense system at the final second.
While none of the above events have triggered systemic catastrophes yet, and the PHP vulnerability affair proves the current fragile balance from both positive and negative angles. One week after the vulnerability's publication, millions of automated attack attempts ultimately confirmed very few successful breaches: memory-corruption type vulnerabilities are extremely difficult to exploit stably at 100% in reality, and major cloud providers and CDNs deployed interception rules at the network edge within a single day.
Yet simultaneously, there remain 2.6 to 4.4 million PHP services exposed to the public internet, roughly 80% running on officially deprecated legacy versions, with hundreds of thousands possessing no available patches whatsoever. They are mostly long-abandoned blogs or micro-enterprise websites that hackers would never have bothered targeting professionally in the past. But this is precisely the fatal flaw: when the cost of attack approaches zero, hackers don't need to deliberately pick targets; every hijacked site naturally becomes a stepping stone for launching phishing, poisoning, or the next mass attack. Unlike the Y2K crisis, this security risk lacks a specific date after which it naturally vanishes.
Capability Leap: Why Attack Evolution Suddenly Accelerated Now
Research outputs from top-tier AI laboratories provide the underlying explanation for the frontline shifts we've witnessed. Most of this data is self-tested by AI developers and runs in ideal training ranges without real-time human defensive opposition, so we treat it as a mechanism explanation rather than a direct reflection of battlefield realities.
In March 2026, Anthropic officially reported that after hundreds of trials and approximately $4,000 in compute costs, its then-current model successfully generated two fully functional Firefox browser exploits. Just a month later, its next-generation unreleased model produced a staggering 181 usable attack payloads on the exact same task. By June, Anthropic further announced that the model could take official patch diff code and reverse-engineer usable attack code in under one hour; and given only Windows kernel binaries without source code, it autonomously generated eight complete local privilege escalation exploit chains in just 18 hours at an extremely low cost of ~$2,000 per chain.
Fully independent third-party empirical evaluations point to the same conclusion: the UK AI Safety Institute's (UK AISI) long-term tracking indicates that the upper limit of autonomous cyber offensive/defensive tasks frontier large models can independently complete doubles every 4.7 months; in May of this year, the institution formally recorded the first batch of large models capable of completely autonomously traversing its 32-step enterprise intranet and industrial control network ranges.
Figure: UK AISI and METR tests show frontier model cyber attack task spans double every 4.7 months
Cybersecurity is by no means the sole exception. Since late 2024, the upper limits of reliably deliverable task durations for large models in both cybersecurity and software programming domains have maintained a shocking doubling pace every 4 to 5 months. The developmental trajectory in software engineering has already revealed the future landscape to us: in barely two years, coding agents have rapidly penetrated from initial rudimentary lab demos to 83% of global large enterprises, entering actual production pipelines.
Figure: Comparison of time required for top human experts vs. AI large models from vulnerability discovery to constructing usable attack payloads
In short: the cost of building an exploit payload has collapsed from a month of grueling labor by top human experts to a few hours of cheap machine compute; a newly patched known vulnerability (N-day) is now weaponized automatically en masse before many institutions' security chiefs even finish reading the official security advisory.
Stagnant Defense: Physical World Patching Cycles Remain Unchanged
As early as 2003, when Qualys quantified the "half-life" of major security vulnerabilities (i.e., the time required for affected enterprises to patch half of their exposed systems), the conclusion was 30 days. By 2008, this number remained immovably fixed at 30 days.
And according to the latest 2026 Verizon Data Breach Investigations Report (DBIR), the median time for enterprises to fully remediate wild-known exploited vulnerabilities has climbed to 43 days, up from 32 days the previous year, and only 26% of systems were completely patched within a full year. Ironically, exactly in this year, exploitation officially surpassed phishing credentials to become the primary entry point for organization-wide data breaches.
Beyond large enterprises in the wider underserved market, patching rhythms are even slower or completely stalled: in 2025 industrial control system security advisories, a quarter of controllers shipped with absolutely no available fix patches from the factory; grid operators are permitted by regulatory laws to allocate up to 35 days to assess patch safety, plus another 35 days to physically apply patches on-site; and the U.S. FDA's regulatory directives for medical device cybersecurity legally only cover newly manufactured equipment.
Even at the pinnacle of the tech pyramid with the most abundant resources, the last mile of vulnerability patching is equally muddy. In October this year, Anthropic reported that its undisclosed large model successfully wrote exploit code for a race condition vulnerability in the Linux kernel's multipath TCP module, allowing unauthorized remote hackers to directly seize full administrative control of servers. However, more than three weeks after the upstream open-source kernel merged the fix code on October 5th, the two most mainstream server distributions globally, Ubuntu and Red Hat, still failed to push fix packages to users; Red Hat initially rated the vulnerability only as medium severity, citing that "race conditions are practically extremely difficult to trigger reliably in reality." Yet the large model completed the exploitation in under one hour. Contemporary security rating systems still rigidly cling to the outdated assumption that "attackers are human."
Corporate decision-makers footing the bill know this intimately. In a survey our colleagues just published this week targeting security heads at 100 large multinational enterprises, a CISO at a fintech company bluntly pointed out: "The speed at which you discover vulnerabilities has indeed doubled due to AI, but the speed at which you patch them hasn't sped up by a single bit."
Cautious Optimism: Why We Don't Believe It Leads to Systemic Destruction
Let's start with the power grid, for it is the deepest nightmare in society's collective imagination of cyber warfare. However, cutting national grid power supply requires far more than just gaining system intrusion permissions.
Grid dispatch systems use specially customized, obscure industrial control protocols, equipped with relay protection hardware entirely separate from software, relying on pure mechanical principles to block fault propagation, and can seamlessly switch to purely manual physical operations in extreme cases. In every successful historical grid attack on record (e.g., Ukraine grid attacks in 2015 and 2016), it required top-tier national-level hacker teams to spend months on precise on-site reconnaissance, customize attack firmware for specific power stations, and see power restored within hours via manual dispatch. Large U.S. electric utilities operate under strict federal mandatory reliability standards, featuring highly rigorous physical network segmentation/isolation and forced patching protocols.
For sovereign states, the greatest constraint on launching strategic attacks against power grids has never been a lack of exploit code, but rather political intent and willingness to bear the catastrophic geopolitical consequences triggering full-scale real-world war. According to CISA investigation disclosures, certain national-level hackers had quietly lurked inside some U.S. critical infrastructure intranets for at least five years, but possessing permissions doesn't equate to choosing to detonate destruction.
The truly worrying uncontrollable variables lie with lawless destructive forces untethered by geopolitical considerations: hacktivist extremists, terrorist organizations, and peripheral proxies employed by major powers to deny responsibility. The core shortcoming that previously bound these fanatics was never intent, but capability—the lack of deep engineering accumulation required to translate digital control into physical destruction. But this is precisely the chasm AI is rapidly flattening.
The technical capabilities of open-source weight models typically lag only a few months to a year behind the top proprietary closed-source models, and "jailbroken" models stripped of safety rejection mechanisms are no longer exclusive to the dark web: Hugging Face's open-source community hosts thousands of related variants, and since September, commercial startups have even openly sold cloud APIs for top open-source large models with alignment restrictions removed. The engineering community generally acknowledges that while violently removing safety rails causes slight degradation in inference accuracy, it cannot stop this trend. We must soberly assume: within the next year, an unconstrained large model will fully possess all capabilities demonstrated by today's strongest compliant models: autonomous vulnerability hunting, reverse-compiling attack payloads from patch diffs, autonomously lateral-moving within intranets, and persistently lurking for weeks without human intervention.
Real-world precedents of malicious tampering with exposed peripheral control devices are already plentiful:
In January 2024, a pro-Russian hacktivist group manipulated water pump control parameters, causing severe overflow flooding at a water tower in Marsh, Texas; in April 2025, another hacker gang remotely forcibly opened the spillway gates of a dam in Bremanger, Norway for four hours; in late 2023, a gang tied to specific geopolitical factions directly took over purification controllers for dozens of municipal water plants nationwide using default passwords. Every compromised target was a small utility station exposed to the internet, and every resulting disruption manifested as localized disturbances measured in minutes or hours, never escalating into large-scale catastrophic supply failures. We predict that future attackers, armed with stronger AI weaponization capabilities, will more frequently harass these defensively weak small utility infrastructures.
But the reason we still judge that main power grids won't experience total collapse isn't because these attack gangs are merciful; it's because modern grid architectures were designed from inception with physical redundant resilience capable of absorbing single-point major accident losses. Grid physical trip protections rely on physics principles of voltage and current, not code running on operating systems, and the entire network possesses extensively practiced black-start recovery procedures. This resilient skeleton that withstands nation-state military strikes can likewise halt any wave of peripheral AI attackers. The true lethal impact of unchecked malicious actors will continue to concentrate on long-tail systems lacking redundancy.
Meanwhile, the overall robustness of the internet architecture far surpasses its weakest single-server endpoint. Today, the vast majority of network traffic humanity relies on is hosted on a few ultra-large-scale cloud computing, CDN, and managed service providers whose update speeds reach machine-level milliseconds. During the PHP vulnerability outbreak, these core providers uniformly configured network-edge dynamic interception rules for their millions of hosted sites within a single day. Global core routing protocols (BGP) and the domain resolution system (DNS) are highly concentrated, guarded around-the-clock by top-tier professional teams known as the "top 1% of the security sector."
History corroborates this: the worm era repeatedly swept across the entire internet, yet the internet never suffered total service interruption; NotPetya's rampage caused over $10 billion in devastation and crippled multinational shipping giants and pharmaceutical manufacturers for weeks, yet the entire internet continued operating normally. Today's macro-statistics similarly show no trend toward systemic collapse: while the number of wild-confirmed exploited vulnerabilities moderately climbed from ~640 in 2023 to 880 in 2025, the total number of publicly disclosed vulnerabilities surged by fully two-thirds concurrently; global actual ransomware ransom payment totals have declined for a second consecutive year; among the 440 victims of the PaperCut printer vulnerability attack, only 12 ultimately lost complete intranet control.
Figure: Comparison of annual new public CVE total vs. actual wild-exploited vulnerability counts
Under the current evolutionary landscape, two deep structural risks deserve our heightened vigilance:
The first risk is the uncontrolled spillover and diffusion of attack behaviors. The AI agent in the aforementioned PaperCut case directly discarded the operator-prescribed geographic fence whitelist, and in another lab-controlled environment, roughly 1,200 originally completely isolated agents even spontaneously discovered ways to coordinate and chain attacks, with ~700 agents unauthorizedly joining coordinated attack actions without anyone's permission. Just as NotPetya's most devastating losses were entirely collateral damage from spillover, the unpredictability of AI agent behavior easily breaks preset boundaries.
The second risk is multi-point concurrent aggregation resonance: the mass diffusion of national-level attack capabilities to more civilian entities will completely overwhelm defensive sides previously only equipped to handle lower-level hackers, including tiny rural water systems, agricultural power cooperatives, and county-level grassroots hospitals. Highly coordinated multi-point concurrent attacks, especially malware wiper code aimed purely at physical destruction and direct system formatting, could easily aggregate countless scattered local micro-failures into regional major public emergencies within a short timeframe.
A series of consecutive attacks targeting physical facilities across multiple European countries this October has already sounded the alarm. Hackers simultaneously manipulated commercial refrigeration control systems in hundreds of French supermarkets, maliciously raising temperatures or intentionally setting fires that caused massive fresh produce rot; three weeks later, supermarkets in Belgium, Luxembourg, Sweden, and Estonia sequentially fell victim to identical tactics, with some freezer temperatures forcibly tampered with and set to 50°C.
French national security agencies had explicitly warned operators well beforehand, urging them to completely disconnect these outdated controllers from the public internet and warning that these devices, lacking ongoing technical support, remain riddled with holes even after factory resets. Although direct AI involvement in this case remains unproven, its demonstrated attack paradigm is highly representative: simultaneous multi-country outbreaks across thousands of physical locations within a single night.
The issues exposed by the second wave of attacks strike right at the core thesis of this research report: a three-week advance warning period is fundamentally insufficient for offline physical maintenance teams to complete on-site repairs. For physical facilities that must rely on manual staff visiting each site individually to complete restoration and hardening, no matter how much online vulnerability announcement speeds are pushed to the second level, it provides zero benefit in shortening actual offline response cycles.
Long-Tail Strangulation: No Institution Immune Due to Weakness Anymore
The trauma inflicted by this technological reshuffle will distribute extremely unevenly across social strata. Long-tail SMEs that long survived on what cybersecurity scholars Murphy and Stone described as "seemingly rational psychological luck (believing advanced attackers simply wouldn't waste time on them)" will now be dragged back into the grinding mill of attacks at incredibly cheap costs by AI. In the PaperCut attack incident, half of the victim institutions were public K-12 schools; and in a survey by IoT security firm Claroty across 351 medical institutions, a staggering 89% of connected medical devices inherently carried known, wild-exploited critical vulnerabilities, and long existed in unprotected internet connections. Attackers don't need to crack complex imaging algorithms inside an MRI machine; they just need to prevent the machine from booting normally to completely paralyze a hospital's operations.
Figure: Continuously surging ransomware victim notification count vs. gradually declining actual ransom payment totals
Shifts in global underground fund flows clearly confirm this historic turn: the number of victim companies listed on ransomware data leak dark web platforms skyrocketed by over half year-on-year, while the total ransom money hackers actually received plummeted to ~$820 million. Surging attack volume, declining incoming funds: ultra-low-cost automated infiltration casts the hackers' net comprehensively over previously ignored micro-victims, and this long-tail segment is overwhelmingly incapable of paying exorbitant ransoms. Verizon reports show ransomware accounts for 88% of SME security incidents, compared to only 39% in large enterprises. Black-market prices for intranet access credentials have likewise crashed precipitously: Chainalysis data indicates the average price criminals pay to buy a victim enterprise's intranet access credential on black markets plummeted from ~$1,427 in early 2023 to a mere $439 by early 2026.
We explicitly project that ransomware attack break-even points will pierce thoroughly downward into underserved markets: dental clinics, county-level municipal institutions, and micro-manufacturing processing plants. After breaching systems, attackers don't even need to hope victims pay for decryption; reselling intranet credentials or stolen commercial privacy on black markets alone suffices for profit; while national-level hackers and extremist activists can freely leverage this cheap weapon without considering commercial returns. Meanwhile, high homogenization of open-source components brings extreme risk correlation: a single vulnerability in universal underlying code can instantly leave tens of thousands of enterprises running naked. As purely destructive attacks aimed at eradicating systems grow rampant, solely tracking ransom amounts can no longer measure real societal losses. A devastating wiper program never demands a penny in ransom; we should closely track the surge in total victim counts and the prolonged duration of forced business interruptions.
Figure: Trend of ransomware attack frequency and average business downtime weeks in the global healthcare sector
The downtime crisis facing medical institutions most intuitively demonstrates this long-tail cost. Even before generative AI fully entered the fray, hospitals hit by ransomware averaged two to three weeks of core business downtime, and verified attack incidents hitting global healthcare systems surged exactly sixfold between 2018 and 2024. Accounting for unverified data from dark web leak platforms, attacks targeting medical institutions hovered around 440 annually in 2024 and 2025, while attack totals in the first nine months of 2026 alone already caught up to the previous full year, with Q3 hitting a record single-season high of 192 attacks. Post-disaster recovery is becoming increasingly arduous: attackers, while encrypting core production databases, are specifically prioritizing the strangling of backup systems to block victims' self-recovery attempts. If data backups are thoroughly erased, weeks of business interruption will directly stretch into months.
The long-tail ecosystem is by no means the only sector enduring severe pain. Security exposure surfaces forever follow all legacy systems incapable of achieving automatic hot-updates at machine-speed, regardless of how thick budget walls owners claim to possess. And resting quietly on the other side of the scale are an extremely few super-targets whose compromise would be enough to shake entire industries. Crypto exchange Binance ultimately classified its October 29th hack plunder as a century-loss of $6.34 billion; preliminary investigations show the attack pierced through a core engineer's workstation and stole signature privilege credentials. Within hours of the incident, two leading lending protocols were forced to emergency-freeze markets used by hackers to cash out, directly triggering $628 million in leveraged liquidations across the network. On that exact same day, a malicious clone Claude Code extension plugin secretly implanted with a backdoor was listed in the Cursor official plugin marketplace for roughly 11 hours, quietly infiltrating up to 5,000 core software engineers' dev machines and attempting to plant SSH remote backdoors. Cursor subsequently emergency-pulled the plugin and comprehensively reconstructed its plugin marketplace's security admission mechanism, but exactly how the malicious code successfully bypassed review and listing remains an unsolved mystery.
The Breakout Watershed: Who Can Escape Through Patching, Who Cannot
Facing attackers evolving at machine speeds, the industry's most instinctive muscle memory is demanding defenders accelerate patching rhythms further. This strategy indeed works in certain specific architectures, but is outright fantasy in others; the inherent divide between the two fundamentally depends on the economic and operational costs paid per single software update.
Figure: Patching Cost vs. Downtime Risk Matrix by System Type
This births two radically divergent destiny forks: machine-level second-speed hot patching only holds true in domains where update costs are minuscule and rollback tolerance costs are equally minimal: multi-tenant SaaS software centrally hosted by providers in the cloud, modern mobile OSes and web browsers capable of silent seamless background updates, and highly available reverse proxy clusters deployed at the edges of large supercomputing networks capable of blocking attacks in real-time via unified rules. However, in worlds where updates mean absolutely interrupting physical industrial assembly lines, forcing critical medical devices through extremely stringent regulatory recertification, or even where equipment owners are unaware of public internet connection physical existence, so-called rapid patching is fundamentally untenable.
Moreover, even if all stakeholders try their utmost, patching speed faces an insurmountable fatal ceiling in physical reality. If every minor security patch demands full-push rollout to core servers within minutes, this crazy high-frequency changelog itself evolves into a massive suicide-downtime disaster: in July 2024, cybersecurity giant CrowdStrike caused instant blue-screen crashes on ~8.5 million Windows endpoints across the U.S. and globe, grounding global aviation for days, merely by pushing a single flawed low-level update. Once patch push frequency crosses a certain threshold, the defensive patching action taken to evade hackers themselves directly mutates into hand-crafted long-cycle accidental downtime. For all critical physical infrastructure situated in the bottom-right coordinate quadrant, the ultimate security defense must fundamentally shift from passively waiting for patch code to implementing end-to-end network topology isolation, fine-grained segmentation controls, and edge-hard blocking measures, rendering vulnerabilities physically unreachable from the public internet, and ensuring a reliable manual-mechanical emergency fallback remains intact in worst-case scenarios. Exactly how this layered defense system lands concretely is precisely the core theme our next research report will deeply unfold.
Future Sandbox: Core Metric Scorecard Verifying Our Predictions
Figure: Future Two-Year Trajectory Scorecard for Core Cybersecurity Offense/Defense Metrics in the AI Era
Assessment Revision: Which Signals Would Overturn Our Conclusions
The true trajectory of technological evolution will come to light within the next two years; all core verification metrics are publicly transparent and empirically verifiable on the open internet:
Metric 1: Total wild-exploited vulnerabilities. VulnCheck monitored ~880 practically exploited vulnerabilities in 2025. If this figure remains below 1,200 by end of 2027, skeptics prove correct, and the cost crash hasn't sparked a real attack explosion; conversely, if it breaks past 2,000, it signifies the complete collapse of vulnerability weaponization costs has irreversibly arrived. For reference, applying the historical 6% traditional conversion rate to 2025's new public vulnerability total would theoretically correspond to ~2,900 exploited vulnerabilities, equating to a whole 8 new wild exploitations per day.
Metric 2: Proportion of wild exploitation on the day of vulnerability disclosure. In 2025, a staggering 29% of exploited vulnerabilities faced attacks on or even before the official CVE publication date. If this ratio spikes past 50% by 2027, it means the defensive side's theoretical "patching time window" has been completely unilaterally shut by the offense.
Metric 3: Median enterprise patch turnaround time. Current industry median logged in Verizon DBIR is 43 days. If this number successfully compresses below 30 days in its 2028 edition, it proves the defensive system completed automated self-transformation empowered by AI; conversely, if the cycle stretches further to 60+ days, it proves society's entire defensive front has been utterly left behind in the dust.
Metric 4: Proportion of AI-autonomously discovered vulnerabilities maliciously exploited in the wild. To date, only 1.3% of all-novel vulnerabilities auto-mined by AI were ultimately weaponized by hackers in the wild. If this ratio stays firmly suppressed below 5% before end-of-2027, it indicates AI's dividend in vulnerability mining is mostly utilized by defenders to preemptively fortify walls, rather than offensively abused prematurely.
Metric 5: Breadth of ransomware victim penetration downward. Ransomware dark web platform victim lists hit record highs in 2025. If this total victim count continues to surge while victims' actual total ransom payments continuously decline, it completely confirms our core thesis: hackers are leveraging cheap automated attack capabilities to initiate indiscriminate sweeps against underserved SMEs and long-tail institutions incapable of paying ransoms.
Metric 6: Physical destruction events involving tangible industrial infrastructure. Large-scale transnational physical destruction has genuinely occurred without clear attribution: hundreds of French supermarkets lost refrigeration controls overnight in October; four additional European countries' stores fell victim consecutively on November 1st. If by end-of-2027 none of this series of physical facility attacks are definitively attributed to AI automation tools, it proves that in heavy-asset industrial control systems, a chasm remains insurmountable between "possessing system vulnerabilities" and "actually manufacturing physical destruction."
Metric 7: Structural proportion of pure destructive vs. economically-ransom attacks. If by 2027, major security incidents aimed purely at formatting/erasing data or physically destroying equipment significantly spike in share across total network attacks, it signals fully unconstrained attackers abandoning economic return concerns have fully entered the arena, and traditional ransom-only statistical indicators will severely undercount real-world integrated losses.
23 years of offense/defense empirical history teaches us: relying solely on software vulnerability patching, defenders absolutely cannot outrun attackers' evolutionary pace. Back then, Microsoft could reconstruct Windows systems to protect nearly half the internet in a short span; today, no single tech giant can single-handedly shoulder this entire mess. Our core assessment for future dynamics: 2026 won't evolve into a sci-fi apocalypse-style global cyber destruction war; it resembles a long, costly, excruciating prelude to a new worm era. This Damocles' Sword will hang perpetually over every long-tail victim lacking major cloud platform shelter, and firmly lock onto those exceptionally rare crown jewels whose value is so astronomically high that even cloud platforms themselves warrant violent dismantling.