Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds

A new Moody’s report found that known exploited vulnerabilities take a median time of 87 days to be patched.

This leaves half of these flaws unremediated after three months of their disclosures.

This gap is even larger for vulnerabilities with no known exploitation evidence, for which median time to patch is at 107 days, the report showed.

Meanwhile, AI-powered vulnerability discovery is accelerating, driving a surge in security findings that organizations must assess and address.

For instance, Microsoft broke its own records for the number of security updates released across three consecutive Patch Tuesday rollouts, underscoring the growing pressure on security teams to keep pace with emerging vulnerabilities.

AI-Driven Attacks Threaten to Widen the Patching Gap

The Moody’s report also warned that AI agents are already capable of exploiting vulnerabilities and compromising systems within days. It documented containment failures during developer testing at OpenAI and Anthropic, although OpenAI’s case involved an internal evaluation rather than an attack by a threat actor.

The report noted that no comparable threat-actor campaign at that scale has been publicly documented.

However, the barriers to fully autonomous cyber-attacks are likely temporary, Moody’s analysts noted.

High computing costs and restricted access to frontier AI models currently limit their use in large-scale campaigns. The report cited the UK AI Security Institute, which estimated that the cyber-capability gap between open-weight and frontier models had narrowed to four to seven months, from six to 10 months previously.

Organizations with weak patching practices face the greatest credit risk, according to the Moody’s report.

Those with large digital networks are particularly exposed because their broader attack surfaces create more opportunities for exploitation. Smaller and mid-sized companies could also become more economically viable targets as AI reduces the cost and effort required to carry out cyber-attacks, the analysts noted.

Published on October 19, this Moody’s report uses February 2026 data from Bitsight Technologies that accounted for vulnerabilities disclosed over previous two years.

“Meaningful advances in AI's offensive cyber capabilities since then may have further reduced the average time to exploit; remediation times may also have changed,” the Moody’s report noted.