{"id":90137,"date":"2026-09-01T21:50:11","date_gmt":"2026-09-01T20:50:11","guid":{"rendered":"https:\/\/www.n-able.com\/?p=90137"},"modified":"2026-09-01T21:50:41","modified_gmt":"2026-09-01T20:50:41","slug":"ai-changed-how-attackers-operate","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/de\/blog\/ai-changed-how-attackers-operate","title":{"rendered":"AI changed how attackers operate"},"content":{"rendered":"

Has your patch strategy kept up?<\/h2>\n

TL;DR:<\/strong> AI has collapsed the time between vulnerability disclosure and active exploitation from weeks to hours1<\/sup>. Third-party applications remain the most exploited and most under-managed attack surface2<\/sup>. N-central\u2122<\/sup> and N-sight\u2122<\/sup> answer both with a single, AI-accelerated workflow that scans, prioritizes, remediates, and verifies vulnerabilities across 900+ applications on Windows, macOS, and Linux, without tool switching.<\/p>\n

A record 48,185 CVEs were published in 2025, roughly 131 every day3<\/sup>, and forecasts point to between 70,000 and 100,000 in 20264<\/sup>. Vulnerability exploitation now sits behind 20% of all breaches, up 34% year over year5<\/sup>.<\/p>\n

That is not a patching backlog. It is a structural mismatch between how fast threats move and how fast most IT teams can respond. The teams that close the gap do more than patch faster. They consolidate workflows, cut manual triage, and use AI to operate at a speed that matches the threat.<\/p>\n

How the threat landscape shifted<\/h2>\n

Attackers are not waiting for your next patch window. Work that used to require a skilled human researcher, from vulnerability discovery to exploit weaponization to attack chaining, is now automated in hours with AI-assisted tools and open-source offensive frameworks6<\/sup>. The disclosure-to-exploitation window has collapsed: nearly 29% of vulnerabilities added to CISA\u2019s Known Exploited Vulnerabilities catalog in 2025 were exploited on or before the day their CVE was published1<\/sup>.<\/p>\n

The math is unforgiving. The average team takes 30.6 days to deploy a patch. Attackers weaponize the same vulnerability in 19.5 days1<\/sup>. That is an 11-day exposure window, and attackers only need one of those days.<\/p>\n

AI has also lowered the skill barrier. LLM-powered phishing, automated reconnaissance, and AI-assisted exploit generation let less-experienced adversaries operate with the capability of senior researchers. The pool of capable attackers is widening, not just quickening.<\/p>\n

Third-party applications are the hardest part<\/h2>\n

Operating system patching gets the attention. Third-party applications get the exploits. Browsers, PDF readers, communication tools, developer utilities, and runtime libraries are the largest, fastest-changing, and most-exploited surface in any environment, yet most patch tools are built OS-first and treat third-party support as an afterthought7<\/sup>. Seventy percent of accumulated security debt traces back to third-party library flaws5<\/sup>.<\/p>\n

Fragmentation compounds the problem. One tool for Windows, another for Mac, a third for Linux, a fourth for third-party apps, each with its own catalog, cadence, and blind spots. The apps a tool skips are the apps that get exploited. Manual tracking gives out at this volume, and lean teams default to patching what is loudest while the rest of the surface stays exposed.<\/p>\n

What closing the gap takes<\/h2>\n

Three things have to work together, and most teams have none of them fully in place:<\/p>\n