Frontier AI does not merely accelerate cyber threats. It fundamentally changes the timeframe within which organisations must detect, decide and respond.
According to ENISA recent analysis, advanced AI models can accelerate the entire attack chain—from vulnerability discovery to exploitation. Code capable of exploiting a newly identified vulnerability may be produced rapidly, while the journey from initial access to data theft may take only hours.
The central question is therefore no longer simply whether an organisation has appropriate security tools. It is whether its defensive and decision-making processes can keep pace with attacks operating at machine speed.
When the Patching Window Disappears
Traditional vulnerability management assumes there is sufficient time between the discovery of a flaw, the release of a patch and active exploitation.
That assumption is becoming less reliable.
ENISA describes a potential “negative exploit time” scenario, in which attackers may possess the knowledge or code needed to exploit a vulnerability before a vendor patch becomes available. Frontier AI is not merely a faster search tool: it can interpret application logic, connect configuration weaknesses with permission issues, and construct complex attack paths from those findings.
For this reason, a vulnerability’s CVSS score alone is no longer sufficient for setting remediation priorities. Organisations must also consider:
- Is the affected system internet-facing?
- Does it support business-critical data or services?
- Can it be combined with other weaknesses to create an attack path?
- How likely is active exploitation?
- Are compensating controls currently reducing the risk?
The Authority Gap: When the Organisation Is Slower
One of the greatest obstacles to effective defence is often organisational rather than technical. ENISA refers to this as the Authority Gap: an attack unfolds in minutes, while the organisation may take days or weeks to approve a critical action.
Change management, testing and Change Advisory Board approval remain important controls. The problem arises when every intervention follows the same slow approval route—even when the risk requires immediate action.
The objective is not to deploy every patch automatically into production. It is to enable the organisation, through predefined rules, to reduce risk rapidly and in a controlled way.
For example, where a high-risk vulnerability affects an internet-facing system, the organisation may have pre-approved playbooks to restrict access, isolate an affected endpoint or temporarily disable a vulnerable service.
What Machine-Speed Defence Requires
In the Frontier AI era, defence must become partly automated, measurable and risk-based.
| Traditional approach | Required direction |
|---|---|
| Manual approval in every case | Pre-approved, risk-based automation |
| Perimeter-centred defence | Zero Trust and assumed compromise |
| Manual management of CVE lists | Prioritisation based on EPSS, VEX and business context |
| Response measured in days | Detection and intervention measured in minutes |
| Reactive patching | Secure by Design and a Secure Software Development Lifecycle (Secure SDLC) |
In practical terms, the focus falls on three areas:
- Response: Establish pre-authorised, reversible and logged automated actions.
- Visibility: Correlate telemetry from endpoints, identities, networks, cloud environments and applications.
- Prioritisation: Bring genuinely exploitable, business-significant vulnerabilities to the front of the remediation queue.
The Human Role Remains Essential
Automation does not remove expert accountability. On the contrary, it increases the importance of security leaders and specialists in defining rules, thresholds, business priorities and exceptions.
People must decide at what risk level automated isolation may begin, when a business service may be taken offline, what permissions an AI agent may hold, and which systems must always require a manual decision.
Final Thought
The challenge created by Frontier AI is not solely technological. Alongside their security architecture, organisations must redesign their decision-making processes.
The question is not whether defence should be fully automated. The question is whether the organisation can act in time—and in a controlled manner—when attacks no longer operate at a human pace.
