The European Union Agency for Cybersecurity (ENISA) reports that frontier AI models are drastically reducing the time between vulnerability discovery and exploitation. Attackers now use automated tools to weaponize vulnerabilities within 15 minutes of disclosure, while the average time from initial breach to data exfiltration has dropped to approximately 72 minutes.
This acceleration leads to 'negative time-to-exploit' scenarios, where attackers develop exploits before vendors release patches. Consequently, frequent emergency patching increases the risk of business disruptions due to compatibility issues. Open-source maintainers are overwhelmed by automated vulnerability reports, and legacy systems have become significantly more vulnerable to AI-driven scanning.
ENISA urges organizations to move away from manual security processes and adopt zero-trust architectures and 'assume-breached' strategies. The agency recommends integrating defensive AI tools into software development lifecycles and security operation centers to enable rapid vulnerability triage and automated incident containment.
The report emphasizes that cybersecurity must become a core strategic pillar for European AI investment. By prioritizing the development of autonomous defensive AI capabilities, the agency aims to ensure that organizations can maintain strategic control in the face of increasingly automated and machine-speed cyber threats.
