AI Is Finding Security Flaws Faster Than Companies Can Fix Them. Gartner Named It the Top New Enterprise Risk

On August 25, Gartner published the results of its regular survey of emerging enterprise risks. In April and May it surveyed 316 executives and risk managers across industries and regions. For the first time, AI-enabled discovery of cyber vulnerabilities ranked first. Gartner sees this as a change that can dramatically shorten the time between a security flaw existing, being discovered and actually being exploited. Kevin Mercado of Gartner says that AI increases both the effectiveness and accessibility of vulnerability discovery. A capability that once required an experienced security researcher is gradually becoming available to a much larger number of people and automated systems. If defenders do not accelerate governance, security operations and remediation to the same degree, the pace at which flaws are found may outstrip their capacity to respond. The economic problem lies in the imbalance. A single attacker can use automation to scan a large number of systems and select the most vulnerable target. The defender must verify every flaw, determine its impact, prepare a fix, test it and deploy it without interrupting critical operations. AI therefore changes not only the probability of attack, but also the required speed of internal decision-making. Gartner recommends recalculating risk impact, updating risk tolerance, strengthening third-party controls and accelerating remediation, including automated remediation. The supply chain matters because a company may fix its own systems quickly while still relying on hundreds of programs and services whose response times it does not control. The same ranking of emerging risks also includes autonomous systems operating outside normal organizational oversight and the risk that information integrity is disrupted by false data and generated content. Cybersecurity is therefore converging with AI governance. A company can no longer separate protection of infrastructure from decisions about who may create and use agents and which of their outputs can be trusted. For the board, the main metric is the time from disclosure of a critical vulnerability to its removal. If that period remains several weeks while automated tools can find the flaw and prepare a way to exploit it within hours or days, a larger prevention budget alone will not solve the problem. Governance must also account for the business trade-off. Deploying a fix rapidly may cause an outage or another error, while deploying it slowly prolongs the open window for attack. The company therefore needs predefined procedures, criticality categories and authority to make decisions without a lengthy approval chain. Terms to explain Vulnerability: A technical flaw or weakness that can be exploited for unauthorized access or disruption of a system. Remediation: Removal or mitigation of an identified security weakness, for example through an update or configuration change. Risk tolerance: The degree of risk an organization is consciously willing to accept.

AI Is Finding Security Flaws Faster Than Companies Can Fix Them. Gartner Named It the Top New Enterprise Risk

The full article is available to users registered at Hard Skills