AI spots cyber gaps faster than financial firms can fix them
By Gammatek ISPL, Industrial Systems & Compliance Analyst at Gammatek ISPL
Last updated: September 2026 | 11 min read
Author block: Gammatek ISPL covers industrial and enterprise security trends for Gammatek ISPL, drawing on the company's direct experience helping manufacturing, chemical, and pharma clients manage compliance and risk. This piece draws on Moody's Ratings' 2026 banking sector research and the Cloud Security Alliance's 2026 vulnerability-capacity studies, cited throughout. Gammatek has no financial relationship with any organization named below.
Why This Should Worry You Even If You Don't Work in Banking
Here's the number that should reframe how every security team thinks about 2026: <cite index="12-1,11-1">a 2026 Moody's Ratings report found that in 2025, attackers were exploiting newly disclosed software weaknesses within an average of 44 days — while the typical company took 87 days to fix them, with even well-resourced banks averaging 69 days.</cite> That gap isn't a rounding error. It's a window during which a known flaw sits open, and it's getting wider, not narrower, as AI-driven tools change who finds vulnerabilities first. https://link.amazon/B0aoYJ7x8
This isn't a banking-only story. It's a preview of what every capital-intensive, highly regulated sector — including manufacturing, pharma, and chemical plants — is about to run into as the same AI-driven discovery tools spread beyond big tech and finance. If banks with double-digit percentages of their tech budgets dedicated to cybersecurity are struggling to close this gap, the implications for less security-mature industrial sectors are worth taking seriously now, not after the first incident.
What Actually Changed: AI Didn't Just Speed Up Attackers — It Sped Up Discovery Itself
The instinct is to assume this is purely an attacker problem — AI helping bad actors move faster. That's true, but it's only half the picture, and arguably the less important half.
<cite index="2-1">In July 2026 alone, Google shipped 1,442 Chrome security fixes across three consecutive releases, a volume that had already exceeded the combined total of the previous twenty-three updates after just two of those releases, according to Google's own security blog.</cite> <cite index="2-1">Microsoft's July Patch Tuesday addressed 570 flaws that same month — nearly triple the prior month's count.</cite> <cite index="6-1">The following month, Microsoft's Patch Tuesday hit 398 fixes, marking the two largest patch volumes in the program's history back to back.</cite>
This wasn't attackers getting faster. This was defenders' own AI tooling surfacing flaws that had been sitting undiscovered for years. <cite index="2-1">One sandbox-escape vulnerability fixed in that July Chrome release had reportedly gone undetected in the codebase for thirteen years before AI-assisted discovery tooling found it.</cite>
The uncomfortable truth: AI is making everyone faster at finding flaws — including the vendors trying to fix them. But finding a flaw and fixing it across thousands of enterprise environments are two very different speeds, and that mismatch is the actual story.
The Scale of What AI Discovery Tools Are Actually Finding
<cite index="2-1">National Vulnerability Database submissions grew 263 percent between 2020 and 2025, with a 20.6 percent year-over-year jump in 2025 alone — a pace that forced NIST to abandon comprehensive enrichment of every entry in favor of a risk-based triage model starting in April 2026.</cite> <cite index="8-1">By late July 2026, the NVD had already logged 45,207 flaws for the year, nearly matching the entire total recorded in 2025.</cite>
Independent research firms are finding similar volumes in the wild. <cite index="4-1">Palo Alto Networks' Unit 42 ran an AI system called NOVA across nearly 3,900 open-source projects over two months and confirmed more than 14,000 previously unknown vulnerabilities — 99.4% of which had never been reported anywhere before, and roughly 40% rated high or critical severity.</cite>
This is the part financial firms — and eventually every regulated sector — have to sit with: the flaws being found aren't obscure edge cases. They're substantial, previously invisible weaknesses that have likely existed in production systems for years, surfacing all at once because the tools capable of finding them only just arrived. https://link.amazon/B008Xy2PV
Why Fixing Is Structurally Slower Than Finding
Discovery, at this point, is largely a machine-speed process — scan, flag, rank. Remediation is still a human, multi-step one: triage the alert, confirm it's real, test a fix against production systems, schedule a maintenance window, deploy, verify. Every one of those steps has a person and a calendar attached to it.
That asymmetry shows up starkly in the data on alert quality. <cite index="10-1">One 2026 study from security firm Hadrian found that 99.5% of the findings security teams handle are false positives, with just 0.47% of flagged issues actually exploitable — pushing teams toward ticket management instead of real remediation.</cite> When the volume of alerts multiplies but the signal-to-noise ratio doesn't improve, the honest bottleneck isn't effort. It's the fundamental mismatch between how fast a machine can flag something and how fast a person can verify it's worth acting on.
Adding to the problem: even the fixes generated with AI assistance aren't fully reliable yet. <cite index="6-1">SANS fellow Ed Skoudis, citing 1Password's research, has reported that AI-generated patches fail to fix the underlying flaw — or introduce new defects — more than half the time.</cite> Speed without reliability just moves the bottleneck from "finding time" to "verification time."
What This Looks Like From the Industrial Side (Gammatek's Original Analysis)
Here's the part the banking coverage misses, and where Gammatek's work with manufacturing, chemical, and pharma clients adds a perspective the financial press doesn't have: <cite index="12-1">banks' median 69-day remediation time is actually the best performance of any sector Moody's measured, credited to heavy regulatory frameworks like DORA in the EU and FFIEC standards in the US that force minimum incident-response and patching standards.</cite>
Most industrial plants operate under nothing close to that level of enforced discipline. There's often no equivalent of a bank's dedicated SOC, no regulatory mandate forcing a 69-day ceiling, and — critically — a layer of OT (operational technology) equipment that frequently can't be patched at machine speed even if a flaw is found, because doing so risks halting a production line. If AI-driven discovery tools are already straining well-funded, well-regulated banks, the same tools arriving at under-resourced industrial environments — where the remediation cycle has no regulatory floor at all — represents a materially bigger structural risk, not a smaller one.
This is precisely the gap between "finding a problem" and "proving you fixed it" that compliance platforms exist to close — not by discovering vulnerabilities faster, but by making sure the remediation, documentation, and audit trail actually keep pace once something is found.
What Security and Compliance Teams Should Actually Do With This
A few concrete, non-hypothetical takeaways from this data:
Alert triage needs to become risk-based, not volume-based. With <cite index="10-1">less than half a percent of flagged issues actually exploitable</cite>, teams drowning in AI-generated findings need a filtering layer before human review, not after.
Patch windows built around quarterly or monthly cycles are already outdated. <cite index="12-1">A 69-day remediation cycle was the best-in-class number in 2025</cite> — and the gap has only widened since.
Documentation and audit trails matter as much as the fix itself, especially in regulated environments where "we patched it" isn't sufficient without proof of when, how, and what was verified afterward.
The Bottom Line
<cite index="13-1">Moody's has been direct about the stakes here, stating that the widening gap between AI's capability to discover cyber weaknesses and firms' ability to remediate them is creating structural credit risk for banks — not incidental risk.</cite> That framing — structural, not incidental — is the right way to think about this everywhere, not just in finance. A gap that's baked into how fast machines can find things versus how fast organizations can respond doesn't close on its own. It closes through better triage, faster verification, and — particularly for industrial and regulated sectors without banking's regulatory floor — building the compliance infrastructure now, before the same AI tools currently stress-testing financial institutions turn their attention to manufacturing plants running decades-old OT systems with no equivalent safety net.
Comments