Now or too late

A software vendor discovers a critical vulnerability, develops an update and makes it available to its customers. Just a few years ago, companies often had sufficient time afterwards to test and install this update. Attackers first had to work out which vulnerability had been patched and how it could be exploited. This window of opportunity is shrinking dramatically.
AI can analyse software updates, identify the patched vulnerability and deduce potential attacks from it. What used to take months can now be done in a matter of minutes. In future, it could take mere seconds.
This is changing a fundamental prerequisite of cyber security: time itself is becoming a security factor.

AI does not necessarily make cybercriminals more creative. Above all, it makes them faster. Automated systems can analyse large amounts of code in a very short space of time, combine vulnerabilities and try out different attack vectors. If one approach fails, the next one is tested. And all of this at a speed that a human cannot match.
This poses a fundamental problem for defences. If a security team only responds to an alert after several minutes, an automated attack may well have already swept through the organisation by that point. Human intervention remains vital. But humans can no longer be the first to react at every point in the process chain.

The answer to this cannot be to sit more and more people in front of more and more screens. Even today, security operations centres are generating volumes of data that can no longer be meaningfully analysed manually. That is why large parts of cyber defence must be automated: collecting data, detecting anomalies, cross-referencing information, assessing risks and preparing appropriate countermeasures.
This also applies to patching vulnerabilities. If, in future, AI is able to identify thousands of security vulnerabilities in a codebase within a short space of time, it will not be possible to address them all manually. The same technology that detects vulnerabilities can also develop proposals for rectifying them and subsequently retest the changes. This does not mean that humans will disappear from the field of cyber security. A ‘human-in-the-loop’ approach remains essential for critical decisions. However, technology must take over the tasks that need to be carried out at machine speed.
 

However, speed does not mean blindly automating security decisions. Organisations need to know which risks are particularly relevant and where human judgement remains indispensable. Above all, though, they should not allow themselves to be paralysed by the complexity of the task. Known vulnerabilities are still left unpatched for too long, updates are postponed, or basic security measures are not implemented.
Yet the first step does not have to be perfect. A solid level of security implemented today can be more valuable than a perfect solution that will only be available in two years’ time. Cyber security is thus increasingly becoming a question of the speed of decision-making and implementation.

The well-known ‘now or later’ principle is becoming increasingly ineffective in cyber security. This is because attackers do not wait for organisations to complete their processes, approve budgets or test updates thoroughly. The time between a vulnerability being discovered and it being exploited will continue to shrink. AI will further accelerate this trend.
Companies must therefore adapt their security processes to a world in which attacks occur at machine speed. This includes rapid updates, automated detection and defence, as well as clear decisions on when human intervention is required. It is not about becoming more frantic. It is about being able to act more quickly. Because in cyber security, ‘now or later’ is increasingly becoming: now or too late.