The AI Cybersecurity Arms Race: What Businesses Should Do in 2026

AI cybersecurity threats are changing how attackers find and exploit software weaknesses. For your business, the practical response is to know which systems are exposed, fix the weaknesses that matter most, and check that your defenses work. You do not need to follow every new vulnerability announcement. You do need a clear answer when your IT partner asks whether a newly affected product is part of your environment.

The same technology can help researchers discover flaws before criminals find them. That is a useful development for defenders, provided findings turn into fixes. The challenge for a busy business owner is translating a stream of technical alerts into decisions: what needs attention today, what can wait for a planned maintenance window, and who is responsible for confirming the work.

Why are cybersecurity vulnerabilities increasing?

CVE stands for Common Vulnerabilities and Exposures. The CVE Program gives publicly disclosed vulnerabilities identifiers so vendors, researchers, and IT teams can refer to the same issue. A record is not an attack report, and its publication date is not necessarily the date the weakness was discovered. Source.

NIST reported that CVE submissions increased 263% between 2020 and 2025. Its April 2026 update also said submissions in the first three months of 2026 were nearly one-third higher than the same period a year earlier. Those figures describe the growing volume of submissions, not the number of businesses compromised. Source.

Google's September 2026 analysis recorded 5,045 vulnerability disclosures in January and 10,740 in August: approximately 113% growth. Reporting and assignment practices also influence totals, so the increase cannot be attributed entirely to AI. Source.

For your organization, the useful question is whether an affected product is installed, reachable, and important to your operations. A large global total cannot answer that. Ask for an inventory that includes servers, workstations, firewalls, remote-access tools, and business applications, with a named owner for each.

How is AI helping researchers and attackers?

Google's May threat report describes attackers using AI for vulnerability research, exploit development, reconnaissance, and other tasks. The report attributes one zero-day exploit to likely AI assistance; that assessment should not be read as proof that every step of an attack was autonomous. Source.

On the defensive side, Mozilla has described using AI alongside manual inspection and other testing techniques to find security bugs in Firefox. Finding a bug is only part of the work: maintainers still need to assess it, produce a fix, and get that fix to users. Source.

Google's September AI threat tracker describes growing experimentation with agentic workflows, while explicitly noting it had not observed fully autonomous threat-actor pipelines deployed against targets in the wild. AI assistance and end-to-end autonomous attacks are different claims. Source.

Your response should be practical. When your provider describes an AI-powered threat or defensive product, ask what was actually observed and what action follows. A useful explanation names the affected system, the evidence, and the next step. A broad warning about AI does not tell you whether your accounting application or remote-access gateway needs attention.

How quickly can a disclosed vulnerability become a threat?

Google documented exploitation of BeyondTrust CVE-2026-1731 within four days of public disclosure. The vulnerability had been discovered by an AI research agent. This is a specific observed case, not an average exploitation timeline or evidence that AI wrote the attackers' exploit. Source.

Google also reported that observed exploited vulnerabilities averaged 10.5 per month in 2025 and 18 per month from January through August 2026. The roughly 71% increase uses rounded averages from its dataset; it does not measure the number of attacks or affected businesses. Source.

A routine monthly update window needs an exception process. If a serious weakness affects a system that is exposed to the internet, your team should be able to review it promptly, decide on a fix or temporary mitigation, and confirm the result. The decision should account for the threat and the operational risk of making the change.

Before the next urgent advisory, ask who receives vendor alerts, who can approve emergency maintenance, and who checks devices that were offline during deployment. A named backup owner matters when your usual contact is away. These responsibilities should be agreed before an incident creates time pressure.

What should your business prioritize now?

Start with five questions for your internal team or IT partner. The answers should describe your environment and include evidence, rather than a generic list of products.

Which systems are exposed?

Ask for a current list of internet-facing services and the business reason each is accessible. Include remote-support tools, VPNs, and administrative interfaces. Confirm who owns each service and whether it is still needed. An old access route can remain available long after the project that required it has ended.

Which weaknesses are already being exploited?

CISA's Known Exploited Vulnerabilities Catalog identifies vulnerabilities with evidence of exploitation. Use it as a prioritization signal alongside your own exposure and business impact. Absence from the catalog is not proof that a vulnerability is harmless. Source.

How do we know a fix worked?

Ask for verification of installed versions or a follow-up check, not only a successful deployment message. Keep exceptions visible: the affected asset, reason for delay, temporary protection, responsible person, and review date. Our patch-management guide explains the operating process in more detail.

What limits the damage if an account is compromised?

Review access privileges, multifactor authentication, separation of administrative accounts, and monitoring with your provider. Ask which systems a compromised employee account could reach. The discussion should connect controls to actual work: who can approve payments, administer backups, or export customer records.

Can we recover the work we depend on?

Ask when a representative restore was last tested and whether the recovered information was usable. Name the applications your team would need first after an outage. Recovery planning gives the business a separate line of defense when prevention fails; it does not remove the need to address exposed weaknesses.

What can a cybersecurity risk assessment reveal?

A cybersecurity risk assessment connects weaknesses to their possible business impact. Technical testing supplies evidence for those decisions. NIST's security-testing guide explains how organizations can plan tests, analyze findings, and develop mitigation strategies; it also addresses the benefits and limitations of different testing techniques. Source.

Internal and external penetration testing examine different perspectives. External testing looks at agreed systems accessible from outside your organization. Internal testing examines what an attacker with an agreed internal foothold might be able to do. The scope, authorization, timing, and boundaries should be clear before testing begins.

A useful report explains what was tested, what was demonstrated, what remains uncertain, and what to fix first. It should make the next decision easier for your business. Ask how findings will be assigned, how remediation will be tracked, and whether follow-up testing is included. An assessment is a view of an agreed scope at a point in time, not a guarantee that every weakness has been found.

If you are comparing options, our guide explains the difference between penetration testing and vulnerability scanning. They can support each other, but they do not provide identical evidence.

You can also read our cybersecurity risk-assessment steps for a broader explanation of the process.

How can bdManagedIT help you understand your exposure?

At bdManagedIT, our Cybersecurity Risk Assessment includes internal and external penetration testing. We use the findings to identify potential attack paths and develop a prioritized remediation plan, so you can decide where to focus your time and budget. Think of it as playing offense to drive defense.

The assessment is available whether or not you partner with us for ongoing managed IT services. We can discuss your systems, the concerns behind your request, and an appropriate testing scope before you decide how to proceed.

Learn about our penetration-testing service.

Book a conversation about a Cybersecurity Risk Assessment for your business.