Nikesh Arora of Palo Alto Networks: AI's Ability to Find Vulnerabilities Outpaces Companies' Ability to Fix Them

Cyber threats, which are becoming increasingly sophisticated thanks to artificial intelligence, are forcing companies worldwide to respond to a wave of attacks. These attacks range from hacking refrigerators in supermarkets to large-scale cryptocurrency theft on the Binance platform and issues with widely used web software.

This surge in threats places a significant burden on IT departments, where employees are forced to work around the clock to eliminate software vulnerabilities. In response, some companies are beginning to increase investments in AI-based security tools to manage the increased workload.

A recent cyberattack on European supermarkets highlighted the urgency of the problem. It was the second such attack in three weeks, when hackers raised the temperature in refrigerators and freezers, forcing retailers to discard millions of dollars worth of products.

Marnie Wilking, Chief Security Officer at the service platform Booking.com, noted that the situation is an 'endless game of cat and mouse with very high stakes.' She added that even after blocking one route, attackers quickly move to the next, and hundreds of company engineers are now dedicated to developing AI-based defense systems.

According to the international registry of disclosed vulnerabilities, Common Vulnerabilities and Exposures, nearly 37,000 software or computer system vulnerabilities were registered in the third quarter of 2026, triple the figure from the previous year.

Marcus Noga, CTO of the German hosting company Ionos, which serves seven million customers, stated that events of this magnitude occur weekly or even every few days, whereas previously they happened monthly.

Ionos changed its security methods after a sharp rise in vulnerabilities in July, implementing AI-based monitoring systems to detect threats and using AI-supported tools to patch its systems around the clock.

Cyber threats drive up defense spending

Binance, which was hit by hackers who stole $6.3 billion in cryptocurrency, announced plans to increase investment in AI-enhanced detection systems. Port of Rotterdam is working on creating an AI-based 'cyber shield,' and Siemens is testing advanced AI models for defensive security.

The Dutch food retailer Ahold Delhaize, which manages Stop & Shop and Giant Food chains in the US, suffered two hacks in the last month. The first, in mid-October, led to a loss of over 200 million euros in revenue and triggered a profit warning.

As a result of this incident, Ahold shut down its websites and applications for a week after discovering the intrusion. This week, some of its stores in Belgium and Luxembourg were also victims of refrigerator cyberattacks across a dozen European countries.

CFO Jolanda Poots-Bijl stated that the company is adapting to the new reality, noting that small businesses are particularly vulnerable. She emphasized that AI is a defensive tool that helps detect threats and recover much faster than previously possible.

McKinsey predicts that the global market for third-party cybersecurity products and services will grow from $223 billion in 2025 to $346 billion by 2029.

AI tools help researchers reproduce hacks

Refrigerator attacks demonstrate how AI forces companies to promptly fix vulnerabilities once discovered, according to Sean Tufts, Field Technical Director at cybersecurity firm Claroty. Claroty published a study in August, several months before the attacks began, detailing weaknesses in refrigeration equipment controllers.

Following the first wave of attacks on stores in France on October 11, Claroty researchers used publicly available AI tools to reproduce these flaws and capture a test device, thereby highlighting the risk of further attacks. Tufts reported that they managed to recreate the attack for only $6 and 28 minutes.

The disclosure of two vulnerabilities in the PHP programming language, found using AI, on October 21, which underpins many websites, prompted governments and companies from Tokyo to Helsinki to temporarily take their sites offline as a precaution. In South Africa, the presidential administration took its site offline two days later 'as a preventive measure in response to a global cybersecurity event,' although it did not name PHP.

American internet infrastructure firm Cloudflare reported that attempts to exploit PHP vulnerabilities rose from thousands to millions within hours of their disclosure. The company noted that errors found with AI could lead to more future outages.

Kraft Heinz CEO Steve Kehlen stated that the threat is real and growing, emphasizing that cybersecurity is 'more important today than yesterday, and will be even more important tomorrow.' Holcim CFO Stephen Kindler supported this view. The Swiss building materials manufacturer took its website offline around October 21st at 9:30 PM to apply PHP patches and restored service by midnight. He noted: 'We need to get smarter. Both sides are well-equipped. Both sides use AI, and this race continues.'

Ashish Kumar Chauhan, Chief Executive Officer and Managing Director of the National Stock Exchange (NSE), stated on Saturday that NSE is conducting a thorough check of all elements of its network for vulnerabilities due to the increasing threat of artificial intelligence (AI)-based cyberattacks. He strongly urged brokers to enhance their cybersecurity capabilities.

At the annual capital market conference organized by the Association of Members of NSE India (Anmi), Chauhan emphasized that every market participant must make ensuring the integrity of the trading infrastructure across India a primary function.

He warned about the potential emergence of new vulnerabilities in the coming years and called upon the industry association to create a dedicated task force to identify risks, coordinate response measures, and assist market participants in remediation.

Chauhan reported that the exchange is ready to support brokers through seminars and other forms of assistance, and will also collaborate with the regulator to strengthen participant systems. He advised brokers lacking internal technical expertise to either develop it independently or engage external consultants.

Referencing recent AI-driven cyberattack incidents, Chauhan noted that if individual members fail to address vulnerabilities, it could jeopardize the integrity of the broader market network structure. Furthermore, he raised the long-term issue posed by quantum computing, which has the potential to affect cryptographic systems, including those used for secure communication.

Chauhan added that market participants must prepare for these risks concurrently with the immediate threat posed by AI-based attacks. Although technology has always played a central role in the functioning of capital markets since the early days of NSE, market participants cannot afford to fall behind as threats evolve.

In conclusion, Chauhan stressed that maintaining market confidence requires coordinated efforts from exchanges, brokers, and other institutions, and that the exchange will work with industry bodies and the regulator to help the ecosystem overcome these challenges.

Artificial intelligence is accelerating the process of discovering software vulnerabilities, reducing the time allocated for their remediation. Cybersecurity experts polled by Reuters predict new disruptions in digital services as companies and governments attempt to prepare for the exploitation of these flaws.

A study conducted by VulnCheck, scheduled for publication in the coming days, shows that the number of discovered digital vulnerabilities has doubled compared to the previous year. Issues registered this week on European government websites demonstrate the pressure such discoveries can cause.

Disruptions began on Wednesday after vulnerabilities were found in PHP, a programming language used in many parts of the internet. To prevent attacks, operators rushed to fix their systems. Some temporarily took sites offline because they could not apply updates before potential intrusions.

This race for fixes occurred during a week already marked by other security issues. Vulnerabilities were disclosed in Node.js and Plex, as well as incidents related to the AI platform LiteLLM and the development platform Railway. The Indian certification authority eMudhra also drew attention due to the use of an extremely weak cryptographic key, which could have jeopardized internet users.

Matthew Prince, CEO of Cloudflare, told Reuters that he is aware of other serious vulnerabilities in software critical to network operation. In his assessment, the sector will face difficult months ahead. He noted: 'I think we will have several years where it feels like the sky is falling every week.'

Previously, searching for vulnerabilities in complex programs required specialized knowledge. Developing tools to exploit them could take weeks or months, giving system administrators time to prepare fixes and distribute updates. However, artificial intelligence is shortening this timeframe. Models are capable of continuously analyzing large codebases, finding issues, and helping develop exploitation tools in just a few hours.

Shane Fry, CTO of RunSafe Security, emphasized the change in the pace of this process. He stated: 'What is fundamentally and undeniably changing is the time required both to discover vulnerabilities and for adversaries to be able to exploit them.'

In light of this situation, security teams must handle tasks that go beyond simply identifying code errors. Specialists are concerned about the reduced response time, but there is no consensus on whether accelerated vulnerability discovery will lead to a wave of successful attacks.

Daniel Steinberg, lead developer of the curl file transfer tool, notes that some vulnerabilities found by AI models are complex and difficult to exploit. Rami Rahman from security company ArmorCode also points out that publishing more vulnerabilities does not necessarily mean an increase in successful attacks. The PHP case serves as an example of this difference: threat intelligence firm Hunt.io discovered aggressive exploitation attempts but reported that by 2 PM Eastern Time on Thursday, the tracked attackers had apparently not yet managed to develop a functional tool to use this vulnerability.

Prince mentioned signs of intrusion related to the vulnerability. Nevertheless, he believes that accelerated problem discovery can bring long-term benefits by allowing the fixing of errors that have remained hidden for years.