Patching Is Too Slow to Stop AI Hackers
The fix takes months to arrive, but an AI attacker needs only hours to break in.
Lightspeed Venture Partners · The End of Human-Based Cyber Defense | Yossi Torati, A SecurityYou cannot outpace AI hackers by patching, even if you patch as fast as you can.
That is the argument of Yossi Torati, the founder and chief executive of the cybersecurity company A Security. Patching is still worth doing, he says, but the old system for finding a flaw and fixing it was built for human speed, and AI attackers no longer work at human speed.
The delay starts with discovery. Independent security researchers often spend days hunting down a single weakness in widely used software. When they find one, they privately notify the company that makes the software.
That company then typically gets about 90 days to build a fix before the flaw is made public. Once the fix is ready, the flaw gets a CVE number, which is simply its entry in a public catalog of known computer vulnerabilities, and a patch, or software update, is released.
Then comes the slowest part. Large companies cannot simply push a button. They must test the patch so it does not break other programs, schedule downtime, and roll it out machine by machine across offices and data centers. That friction is familiar to any technology team.
While that relay race is running, attackers using the most advanced AI models, what Torati calls weaponized AI, do not wait. They can find the same weakness and exploit it on the spot, breaking in during the long gap between disclosure and installation.
The workaround, Torati says, is to stop treating the single patch as the only defense. Instead, scan the entire computer network, find the attack path, meaning the chain of connected weaknesses an intruder would actually use to reach something valuable, and break that chain.
That often means adding a compensating control, a temporary block such as a stricter access rule or a firewall setting, alongside the suggested fix. Done carefully, the risk never has a chance to play out, even if the official patch has not yet been installed.
Questions people ask
Why don't companies just install patches immediately?
A bad patch can shut down payroll, email, or factory systems, so technology teams first test updates and then roll them out in stages. Many computers may also be offline, custom configured, or running old software that needs extra work. That caution creates a backlog that attackers can exploit.
What is an attack path, and why does it matter more than a single flaw?
An attack path is the step by step route a hacker would take, such as entering through an exposed login, moving to another server, and then reaching customer data. A network can have thousands of flaws, but only some connect into a complete route to something valuable. Blocking one step on that route can stop an intrusion even before every flaw is patched.
What is a compensating control?
It is a temporary safety measure used when the ideal fix is not yet in place. Examples include blocking a vulnerable feature, requiring stronger login checks, or adding a firewall rule that stops the malicious traffic. It reduces the risk without waiting for the official software update.