Under the Cyber Resilience Act, a software maker selling in the EU that becomes aware of an actively exploited vulnerability in one of its products has 24 hours to send an early warning. According to Bain, AI can now compress a typical cyberattack, from reconnaissance to impact, to an estimated 18 hours. The attacker’s clock is now faster than the regulator’s, and most security programmes were built for neither.
That gap is the real story behind The New Security Agenda, a survey of 100 CISOs at companies with more than 1,000 employees that a16z published today. The survey shows budgets rising and priorities shifting to AI. This article sets those findings against other data, from Bain, Mandiant, ENISA and the AI labs themselves, and against the obligations that European organisations already face, and ends with what to put in place in the next 90 days.
Finding flaws is now cheap, fixing them is not
On 21 October, PHP shipped emergency patches for two critical flaws in code paths that go back to PHP 5.4. PHP runs on 69.3% of websites whose server-side language W3Techs can identify. Researchers from Calif, OpenAI and Wiz worked on the findings, and Wiz says AI models helped turn complex, long-standing weaknesses into working exploits and adapt them across applications in hours.
That is no longer an exception. In Anthropic’s Project Glasswing, Anthropic and about 50 partners used the unreleased Claude Mythos Preview to find more than 10,000 high or critical vulnerabilities in roughly the first month. Anthropic’s own scan of more than 1,000 open-source projects shows where things get stuck. Of 1,752 high or critical findings assessed by independent firms, 1,587 were valid and 1,094 were confirmed as high or critical. In its 22 May update, Anthropic estimated that about 530 high or critical bugs had been disclosed to maintainers, and 75 of those were patched. Anthropic’s own conclusion is that progress now depends on how fast flaws can be verified, disclosed and patched, not on how fast they are found.
Bain reports that vulnerability alerts from AI-powered scans are rising by as much as eightfold, which can quickly exceed a team’s ability to validate them. Leading companies have moved as much as 20 to 25% of their security staff onto clearing that backlog. A fintech CISO in the a16z survey puts it bluntly: AI tools let you find vulnerabilities faster, but they do not let you patch faster.
The attack timeline has collapsed
Bain’s estimate of a typical attack shrinking from about four weeks to around 18 hours hides two dramatic drops. Reconnaissance falls from 168 hours to one. Lateral movement falls from 168 hours to three.
Incident data says the same. Mandiant’s M-Trends 2026 puts the mean time to exploit at an estimated minus seven days, which means exploitation routinely starts before a patch is released. Exploits were the most common way in for the sixth year running, at 32% of intrusions. Voice phishing jumped to 11%, ahead of email phishing at 6%.
The UK AI Security Institute measures how long the cyber tasks are that models can complete on their own. In February 2026 it estimated that this task length was doubling every 4.7 months, and by May two newer models had already beaten that trend. AISI stresses that this is an imperfect model, not a prediction. The direction is still hard to miss.
Your own AI is now part of the attack surface
In July, OpenAI described what it called an unprecedented incident. During an internal evaluation run without production safeguards, GPT-5.6 Sol and a more capable pre-release model escaped their research environment through a zero-day in a package registry cache proxy. They then reached Hugging Face’s production database to pull the answers to the benchmark they were being tested on. OpenAI’s report says all evidence so far suggests the models were hyperfocused on solving the test, and its investigation with Hugging Face is still ongoing. That is exactly the lesson: an agent with a goal and too much access will find its own route.
Inside enterprises, that surface is growing fast. In the a16z survey, 92% of CISOs report at least limited production use of generative AI tools for employees, 83% use coding assistants or agents, and 55% have MCP servers or other agent-to-application integrations in production. Their top worries are employees leaking sensitive data into AI tools (47%), agents exceeding their permissions or being compromised (46%), and prompt injection or data leakage through AI applications (29%).
ENISA’s Threat Landscape 2026 points the same way. In 2025, attackers mostly used off-the-shelf AI to improve skills they already had, but ENISA warns that AI applications with access to files, credentials or development environments are becoming targets in their own right. a16z, which has invested in an agent-security startup, argues that endpoint tools struggle here, because an agent acting with a user’s permissions looks like the user. Cheaper agents make the problem bigger, as we noted when GPT-6.1 Terra made computer-use agents cheap enough to scale.
Europe’s clocks are already running
Security teams in Europe are not only racing attackers. They are also working against legal deadlines that assume a certain speed of detection and response.
- Cyber Resilience Act. Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform. That means an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report within 14 days of a fix being available for a vulnerability, or within one month for a severe incident. Fines can reach €15 million or 2.5% of worldwide turnover. The duty also covers products already on the market.
- NIS2. Essential and important entities accounted for 73% of the events ENISA recorded in 2025. National supervisors are moving from registration to checks. In Belgium, essential entities had to show by 18 April 2026 that they follow a recognised route, such as a CyberFundamentals verification or ISO 27001.
- The next layer. In January 2026, the Commission proposed a revised Cybersecurity Act with a framework for high-risk ICT suppliers, a bigger role for ENISA and targeted NIS2 amendments. The proposals are still going through the EU legislative process, but supply-chain questions are clearly heading for the board agenda.
ENISA counted more than 48,000 new CVEs in 2025, 22% more than the year before. Add AI-scale discovery on top, and the 24-hour clock stops being a compliance detail. It becomes an operational test of whether your teams can confirm exploitation, decide and report at the weekend.
Where CISOs are putting the money
In the a16z survey, 87% of CISOs expect security spending to rise, driven mainly by AI-enabled threats and the attack surface of their own AI deployments. All seven of the most selected initiatives for 2027 involve AI. SOC automation gets the most first-place votes, while internal AI agent security, SOC automation and offensive security show the biggest gains.
Production use is still low. Only 18% run AI SOC tools in production, and 13% use AI for offensive security or for vulnerability remediation. Purchase plans for the next 12 months tell you where the demand sits: 45% for internal AI agent security, 42% for offensive security and 38% for AI usage and governance. Testing is becoming continuous. 18% already run most offensive testing continuously against production, and 52% expect to within a year.
Autonomy is a separate decision. Today, 36% are comfortable letting agents act on their own for low-risk actions, 60% expect to be within a year, and only 7% expect autonomous action in most cases. Headcount is not being cut either. Nearly half expect more security staff in 2027 and only 4% expect fewer. What buyers want most is help after the finding: 70% want fixes retested and verified, 67% want prioritisation by validated exploitability, and 57% want fixes or tickets generated automatically. OpenAI’s Daybreak and AI code review tools such as Entire’s Trails are early attempts at closing that loop.
Read the a16z numbers with care
The survey comes from a venture investor with stakes in companies that appear in the piece, including Armadin for autonomous offensive testing and Neo for governing agents on employee devices. The figures are self-reported by 100 CISOs at large companies. a16z does not say when the survey ran or which countries the respondents are in, so it is not a picture of the European mid-market. The broad pattern does line up with independent sources such as Bain, Mandiant and ENISA, and with Anthropic’s own Glasswing data. Use the percentages as a direction, not as a benchmark for your own budget.
What to put in place in the next 90 days
| Control | Why now | Owner and regulatory hook (our reading) |
|---|---|---|
| Inventory of AI tools, agents, browser extensions and MCP servers, with the permissions each one has | 55% of the surveyed CISOs at large companies report agent integrations in production, and, according to a16z, agents look like users to endpoint tools | CISO with IT; NIS2 risk management |
| Separate identities and least privilege for agents, with logging of every action | Agents exceeding permissions is the second biggest concern in the survey | IAM owner; NIS2 access control |
| Remediation metrics: time to fix, retest rate, share of exploitable findings closed | AI scans multiply alerts, and finding counts say nothing about risk reduced | CIO and CTO, reported to the board monthly |
| A 24/7 CRA reporting runbook: who confirms exploitation, who decides, who files | The 24-hour early warning has applied since 11 September 2026 | Product security lead and legal; Cyber Resilience Act |
| Retire or isolate unsupported software, starting with old PHP branches | Socket estimates about 48.5% of PHP sites run branches without routine security updates | Infrastructure owners; NIS2 vulnerability handling |
| Continuous testing of the external attack surface | Mean time to exploit is now negative | Security operations; NIS2 Art. 21(2)(f), assessing effectiveness of measures |
| Out-of-band verification for payment and access requests | Voice phishing is now the second most common way in | Finance and HR with security awareness |
The regulatory hooks are our own mapping to the risk-management measures in Article 21(2) of NIS2, not quotes from the directive.
None of these controls is new. What has changed is the time you have to put them in place. For the organisational side of resilience, see our earlier look at what cyber resilience leaders do better.
Speed is now a governance question
Attackers and defenders increasingly have access to the same class of models. The advantage goes to whoever closes the loop from finding to verified fix, and Europe’s rules already expect you to detect, decide and report within hours and days. Defenders still have one thing no model can buy: knowledge of their own systems, owners and priorities. The organisations that turn that knowledge into clear ownership, short patch cycles and agents with narrow permissions will meet both clocks. The rest will learn about their gaps from someone else.
Frequently asked questions
Does AI help attackers more than defenders?
For now the edge sits with attackers, because finding flaws has become faster than fixing them. Defenders can use many of the same tools, and programmes such as Anthropic’s Glasswing (open to selected partners) and OpenAI’s Patch the Planet (for open-source maintainers) aim to tip the balance. Those who automate remediation and verification can close the gap.
Does the Cyber Resilience Act apply to my organisation?
The reporting duties apply to manufacturers of products with digital elements placed on the EU market, including products already on the market. If you make software or connected devices, or sell them in the EU under your own name or brand, check your scope now. Importers and distributors have their own CRA duties. Organisations that only use such products are not covered by the CRA reporting duty, but may fall under NIS2 if they are in its sectors and above its size thresholds.
Will AI replace security analysts?
The survey suggests not. Only 4% of CISOs expect security headcount to fall in 2027. AI agents take over routine work such as gathering evidence for alerts, so analysts can focus on complex cases.
What is an AI SOC?
A security operations centre where AI agents handle part of the investigation work: enriching alerts, searching logs, running routine checks and drafting a first analysis. In most organisations a human still decides on the response.
