Your company is now a target for cyber weapons that only intelligence services could afford

Software follows a perverse logic: the longer a flaw goes unnoticed, the more valuable it becomes. The value goes to the attacker who finds it.

A master key that fits every lock

We call it a zero-day vulnerability: a hole the software’s own maker does not know about yet. No update or protection exists. Whoever holds one can quietly get into every company that runs that software. Nation states and intelligence services pay hundreds of thousands to millions of dollars for them on the black market. It is the digital equivalent of a master key that fits every lock in the building, and the owner does not know the key exists.

The first line of defence against such a key is speed. The software vendor has to find the hole and close it. Companies have to roll out the update. That speed was already a problem. With AI, the pressure has grown exponentially.

500 vulnerabilities in a few hours

In February, the research team at Anthropic, known for its AI chatbot Claude, published a report showing that its model Opus 4.6 had found more than 500 zero-day vulnerabilities in production software. These were holes that human experts had overlooked for more than ten years, some for more than twenty. The AI model found them in a few hours.

The report makes the difference between an AI model and a human hacker tangible. A human hacker needs sleep, has a limited working memory and can investigate one hole at a time. An AI model is tireless. It searches day and night, in every corner of every codebase, for a fraction of what an intelligence service once paid for a single vulnerability.

A panic response from the big players

This week Anthropic indirectly confirmed how big the problem is. The company is holding back the rollout of Mythos, its newest and most capable model, because it is even better at finding and exploiting vulnerabilities than its predecessor. In the same breath, Anthropic launched Project Glasswing. It makes 100 million dollars of compute available so that technology companies such as Amazon, Apple, Google, Microsoft and Nvidia, and security vendors such as CrowdStrike and Palo Alto Networks, can find vulnerabilities before they are abused.

When the largest technology and security companies in the world join forces like this, it looks less like a controlled initiative and more like a panic response. These companies realise they have let a genie out of the bottle that they can no longer control on their own.

The cascade that reaches every company

Then the cascade begins, and it reaches every company. Software makers, think of Microsoft, have to develop, test and release a patch for every hole that is found. That barely worked at the old pace. At the scale at which AI now finds vulnerabilities, it is an impossible task.

Next, companies have to install those patches. In practice that takes weeks, sometimes months. Updates are postponed because a deadline is coming, because nobody knows exactly what will break when the system restarts, or simply because colleagues ask why they have to restart their laptop again. And then there are the systems that have not been patched in years, because nobody wants to take the risk of taking them offline.

Do not wait for the results of marketing initiatives such as Project Glasswing. Every system your organisation runs on, from your ERP to your customer portals to your suppliers’ software, is a potential target for weapons that only intelligence services could once afford. Assume they have already been used against you.

Vendors cannot patch fast enough. You cannot roll out fast enough. And exploits are available the moment a vulnerability is discovered.

In risk terms, likelihood is no longer a variable. In practice it equals 1. Every unpatched vulnerability is an active exposure.

What this asks of you in practice

• Put detection and control next to prevention. Ask “would we notice, and how fast could we respond?” as often as “are we protected?”
• Shorten the time it takes to roll out patches, and do not build your resilience on it. Patching remains essential. It is no longer enough.
• Validate your security controls continuously. Ongoing visibility across your whole software estate, including suppliers and supply chains, is the new standard.
• Review your risk register with a likelihood of close to 100%. Unpatched critical vulnerabilities are active exposures.
• Test your response as well as your defences, on timelines that reflect attacks at AI speed instead of human speed.

The organisations that come through this are the ones that stopped asking “could we be hacked?” and started asking “are we ready for when it happens?”

Time is short.