I have said it before and I will say it again: the gap between a vulnerability being disclosed and it being exploited is now measured in hours, not months. Microsoft’s June 2026 Patch Tuesday made that point with brutal clarity. The company disclosed 206 vulnerabilities, including three publicly known zero-days and a critical Azure HorizonDB flaw. One of those bugs, a new Microsoft 365 Copilot vulnerability, lay in software that tens of thousands of organisations are already rolling out.
The speed here matters. In the old world, a patch window opened for weeks. Today, generative AI tools let attackers scan for vulnerable systems and write matching exploit code almost instantly. Verizon’s 2026 Data Breach Investigations Report found that software flaws overtook stolen credentials as the top breach vector, accounting for 31 percent of breaches. That is a gearshift, and it means defenders can no longer rely on passwords or phishing filters as their primary shield.
We need to fight AI with AI. We need to incorporate them into our practices at a scale that we have never done before.
For people managing type 1 diabetes, this is not abstract. Any health data platform, patient portal, or connected medical device running on unpatched infrastructure is a target. The same attacker scanning for vulnerable Exchange servers or Azure services can scan for healthcare systems with the same automated toolkit. Regulatory compliance matters, but so does the practical habit of checking that updates land inside 48 hours, not after the next quarterly review.
What this means for your team or business
A useful test: ask yourself how long it would take to push a critical security update across every machine that touches customer or patient data. If the answer is longer than one week, start treating patching as a safety issue, not an IT chore. That means asset visibility first, then automated deployment, then confirmation. If you are still emailing around a PDF patch list, you are in the danger zone.
The Rise of Shadow AI compounds the problem. Employees using unapproved AI tools often paste sensitive data into interfaces that train on that data or store it indefinitely. In one recent report, unmonitored AI tool use added roughly $670,000 to the average cost of a breach. Those tools do not show up in the standard vulnerability scanner. They show up in policy lapses.
The practical steps
Start with the basics. Enable automatic updates on endpoints where feasible. Lock down administrative access to the smallest possible group. Require any new AI service to state clearly whether it uses submitted data for training. If the vendor cannot answer that in plain language, do not deploy it. Finally, separate your most sensitive data workloads into their own segmented environment. Attackers love shared infrastructure because one foothold becomes many.
The honest truth is that perfect security does not exist. What does exist is the discipline to move faster than the attacker’s patience. A 206-vulnerability day is not an anomaly. It is the new rhythm. You can either build your week around it, or spend your day recovering from ignoring it.
Related reading:
- Anthropic, OpenAI and the race to weaponise AI against insecurity
- Shadow AI just made your next data breach $670,000 more expensive
- Apple just changed how it ships security updates. AI is why.
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
