Exploited Flaws Typically Take Three Months to Patch, Moody's Finds
Infosecurity Magazine, Monday, October 19th, 2026
Moody's says known exploited vulnerabilities take a median 87 days to patch, a gap that grows riskier as AI speeds exploitation.
A Moody's report found known exploited vulnerabilities take a median 87 days to patch, leaving half unremediated after three months, while flaws with no exploitation evidence take a median 107 days.
AI-driven discovery is flooding teams with findings, illustrated by Microsoft setting records across three consecutive Patch Tuesdays.
Moody's warns AI agents can already exploit vulnerabilities within days and cites containment failures in developer testing at OpenAI and Anthropic.
It says no comparable threat-actor campaign has been documented yet but that the barriers to fully autonomous attacks are likely temporary.