500 vulnerabilities a day: A great day to be a Sysadmin

iGuRu.gr > 500 vulnerabilities a day: A great day to be a Sysadmin

The EU's cybersecurity agency, ENISA (from the European Union Agency for Cybersecurity), reports that weaponization of vulnerabilities can now be done within 15 minutes, putting pressure on organizations to adopt defense systems that operate at machine speeds. sysadmin panic

The European Union's cybersecurity agency warned in a recent assessment that frontier AI has reduced the time it takes to weaponize a vulnerability to just 15 minutes, making traditional human-managed patch cycles obsolete.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

This finding was presented in the ENISA report “Cybersecurity in the Frontier AI Era” ( PDF ), published in July 2026. The EU agency notes that automated systems are speeding up every phase of an attack’s lifecycle — from initial recognition to data theft (a process that currently takes an average of 72 minutes). It also highlighted the huge increase in vulnerability detection: one organization previously reported 80 vulnerabilities (CVEs) per quarter, while using AI tools, that number has reached 500 per day.

This significant increase in bug detection has been known for some time, as Microsoft releases many more fixes in "Patch Tuesday" updates, while the release candidates of the Linux kernel are also much larger than in the past.

ENISA says this acceleration in vulnerability detection creates an “authority gap,” where administrator approval processes take longer than an attack scenario would require. Essentially, the human factor is now a bottleneck, given that AI can detect and exploit vulnerabilities so quickly.

Another serious issue raised by ENISA is the ability of the latest AI models to connect several low-severity vulnerabilities by analyzing application logic, configuration settings and API access. This can lead to misleading risk scores for individual vulnerabilities, as their combination can cause greater damage.

To protect against these rapidly evolving threats, ENISA recommends that organizations redirect their resources from the endless process of vulnerability discovery towards automated screening frameworks, such as the Exploit Prediction Scoring System (EPSS) and the Vulnerability Exploitability Exchange (VEX).

At the same time, it states that administrators should conduct strict asset inventories and set detection and response indicators that are measured in single-digit minutes.