AI Speed Gap
Artificial intelligence is rapidly changing the economics of cyber risk, with the ability to identify software flaws now advancing faster than many organisations can patch them, Palo Alto Networks Chairman and CEO Nikesh Arora has warned. His comments reflect a broader concern across the security industry: the same tools that help defenders scan code and detect anomalies are also enabling attackers to search for weaknesses at unprecedented scale and speed.
Arora's warning lands at a moment when enterprises are already under pressure from sprawling digital estates, cloud migration, third-party dependencies and a persistent shortage of skilled security talent. In that environment, vulnerability management has become less a periodic housekeeping exercise and more a continuous operational race. The challenge is no longer simply finding bugs, but deciding which ones matter most, fixing them quickly and proving that remediation has actually reduced exposure.
The Palo Alto Networks chief's remarks also highlight a structural imbalance in cybersecurity. Attackers need to find only one exploitable weakness, while defenders must secure thousands of assets, applications and endpoints across distributed environments. AI intensifies that asymmetry by lowering the cost of discovery. What once required specialised expertise and time can now be automated, allowing threat actors to test more targets, more quickly, and often with greater persistence.
Fixing The Bottleneck
Arora's call for faster and more collaborative vulnerability management points to a growing recognition that traditional patch cycles are too slow for the current threat landscape. Many organisations still rely on fragmented processes, where security teams identify vulnerabilities, operations teams schedule fixes and business units weigh the risk of downtime. That workflow can leave critical exposures open for days or weeks, especially in large enterprises with legacy systems and complex approval chains.
The problem is compounded by the volume of alerts. Security teams are often inundated with findings from scanners, penetration tests and external advisories, but not every vulnerability carries the same level of urgency. Without strong prioritisation, teams can waste resources on low-risk issues while missing the flaws most likely to be exploited in the wild. AI can help sort that noise, but it can also increase the pace at which new vulnerabilities are surfaced, creating a backlog that many firms are not equipped to absorb.
Arora's emphasis on collaboration suggests that vulnerability management can no longer sit solely within the security function. Developers, cloud engineers, product teams and executive leadership all have a role in reducing exposure. Security-by-design practices, tighter coordination between development and operations, and clearer accountability for remediation timelines are becoming essential as software supply chains grow more complex.
Enterprise Pressure Rising
For startups and venture-backed companies, the implications are especially acute. Young firms often move quickly to build products, scale infrastructure and win customers, but that speed can come at the expense of security maturity. Limited headcount and budget constraints make it harder to maintain rigorous patching discipline, even as these companies increasingly handle sensitive customer data and rely on cloud-native systems that are attractive targets for attackers.
Investors are also paying closer attention to security posture as a marker of operational resilience. A startup that cannot demonstrate disciplined vulnerability management may face higher enterprise sales friction, longer procurement cycles and reputational damage if a breach occurs. In that sense, Arora's warning is not only a technical observation but also a business one: the ability to respond to AI-driven threats is becoming a competitive differentiator.
The broader industry response is likely to involve more automation, more context-aware prioritisation and more integration across security workflows. But Arora's message suggests that technology alone will not solve the problem. Organisations will need faster decision-making, clearer ownership and a willingness to treat remediation as a strategic function rather than a back-office task.
As AI continues to compress the time between flaw discovery and exploitation, the companies most likely to stay ahead will be those that can move from reactive patching to continuous risk reduction. For now, the warning from Palo Alto Networks is stark: the machine speed of attack is rising, and many firms are still patching at human speed.