Defenders losing the patch race to AI, research finds

'Agentic AI has collapsed the margin defenders depend on' says Azul

Organisations are struggling to keep up with patching vulnerabilities as attackers use AI tools to accelerate their activities.

That’s according to research commissioned by Java software provider Azul, in which nine in ten security leaders reported an incident or near miss due to slow patching.

Ninety-one percent of UK respondents had experienced an incident or near miss attributable to the patch gap, compared with 85% in the US and 93% in Germany.

The findings add weight to several recent reports that illustrate how AI tools are allowing attackers to speed up their hacking attempts by automating parts of the attack chain.

Azul's 2026 AI Vulnerability Gap Report indicates that IT leaders are aware that the window is narrowing. It found that 65% of UK respondents believe attackers equipped with AI can develop a working exploit within three days of a critical vulnerability being publicly disclosed. Only 52% said their organisation could deploy a critical fix within the same period.

The disparity is even more stark in Germany, where 63% believe an exploit can be developed within three days but just 13% can activate defences in the same timeframe.

There are also signs that patching policy has not yet caught up with the threat posed by automated attacks. Nearly three quarters of UK respondents (72%) have no mandated, time-bound commitment for patching non-critical vulnerabilities, compared with 66% in the US and 65% in Germany.

The risk posed by non-critical vulnerabilities is rising as AI tools can potentially chain them together into more serious exploits.

While these risks are general, the report focuses on Java, which is deeply embedded into many businesses including banking, telecoms and government systems, often supporting enterprise applications and legacy software that may operate with limited institutional understanding. Respondents came from organisations with a significant Java estate.

A lack of visibility is certainly a concern. Forty-five percent of UK respondents admit having only partial or limited visibility of their Java estates. That figure that rises to 51% in the US and 65% in Germany. In the US, only 19% said at least 90% of their production Java estate was running the latest security patch.

The research suggests that the need to test patches prior to deployment is a significant bottleneck to faster remediation, while the complexity and age of enterprise applications are additional barriers.

Scott Sellers, co-founder and CEO of Azul, commented: “Agentic AI has collapsed the margin defenders depend on, and most enterprises are still running patch processes built for a much slower adversary.”