Author: Matt Bornstein (a16z Partner)

Translation: Deep Tide TechFlow

Deep Tide Introduction: Over the past two decades, the global cybersecurity defense system has been established on an unspoken assumption of temporal disparity: from the public disclosure of a system vulnerability to the attackers' ability to write reliable exploit programs typically requires weeks or even months of effort from top human hackers. The defenders rely on this fragile “patch time window” to maintain the daily operation of the digital world.

However, the top venture capital firm a16z pointed out in its latest in-depth research report based on 23 years of attack and defense historical data that this underlying bottleneck supporting the entire internet security system has been completely shattered by AI. Today, the capability of large models to autonomously generate attack code doubles every 4 to 5 months, now matching the evolution rate of code generation. The time required to weaponize a known vulnerability has been reduced to mere minutes or hours, while the patching cycle for global critical infrastructure remains stagnant at 30 to 45 days, with some being unpatchable for years.

Although a16z believes that national power grids and core backbone networks with physical isolation and robust redundancy will not collapse instantly, this undoubtedly declares the end of the era where “the weak are too small to be targets.” As the marginal cost of attacks approaches zero, millions of small and medium-sized enterprises, local hospitals, and water systems will face indiscriminate pillaging. Understanding this asymmetrical tilt in security productivity is crucial for every technology manager and investor.

On the last day of August, a single operator simultaneously targeted a widely used print management server by hundreds of AI agents, which autonomously built a testing lab in a very short time, writing exploit code for two security vulnerabilities disclosed just four days prior, and pulled target lists from internet scanning services, immediately launching a full-scale attack.

The entire process, from an empty workspace to breaching the internal network of the first real victim organization, took less than 4 hours.

The next morning, when the attack started in full, 11 organizations fell within just 26 seconds. By the time cyber threat monitoring agency GreyNoise completed its statistics, 395 institutions across 48 countries had been breached, half of them being schools. The model executing this attack was merely a cheap open-source weight model, far from the forefront flagship large models from top US laboratories. These agents even ignored the operator's preset instruction to “avoid 28 specific countries” during the attack.

Seven weeks later, two extremely severe vulnerabilities in the PHP programming language, used by 70% of websites globally, were unintentionally leaked before the official patches were released.

Four days before the vulnerabilities were officially disclosed, and 12 hours prior to the official patch release, Amazon's bait servers used to entrap attackers were already subjected to exploit attacks; within the following three days, the attackers produced fully functional interactive remote control terminals (Shell).

Amazon's Chief Information Security Officer (CISO) CJ Moses clearly stated: AI “is making the cost of transforming patch comparison differences or vulnerability announcements into usable attack tools extremely cheap,” and that the previously common industry service-level agreements (SLAs) of 7 days or 30 days are essentially based on a time disparity assumption that no longer exists.

Within a16z, these real attack and defense events sparked intense discussions. One faction believes that we are stepping into a terribly bad decade: agents will indiscriminately breach all unpatched targets within hours of vulnerability disclosure, sweeping over grid systems, water supply systems, and hospital networks with repair cycles lasting months or even years.

The other faction, however, has a familiar historical memory: the birth of Metasploit in 2003 once claimed to arm every amateur with network weapons; and the advent of the Shodan search engine in 2009 was thought to expose every industrial controller and IoT device on earth. But ultimately, neither of these ended the operation of the internet.

Core Judgment: The Reality and Boundaries of Attack-Defense Imbalance

For the past twenty years, the core bottleneck of offensive cybersecurity has always been the necessary expert skills and lengthy time required to convert a known vulnerability defect into a set of highly reliable weaponized exploit programs.

However, in 2025 and 2026, this work has become extraordinarily cheap and swift, with the time required plummeting from days or even months to mere minutes or hours. In contrast, the speed of vulnerability patching on the defensive side has not sped up at all, and for large systems globally—particularly critical infrastructure related to national economy and people's livelihoods—there is fundamentally no way to increase the speed of patching.

But this does not mean we are sliding into a comprehensive ultimate disaster. We firmly believe that the national power grid will not suddenly experience widespread darkness, and the entire internet will not be paralyzed as a result.

The real evolutionary picture we anticipate is that the world will soon see a series of widespread outbreaks similar to the 2003 worm era and the 2017 WannaCry ransomware storm. This wave will hit hardest those legacy systems that cannot be patched quickly, as well as a few high-value targets that can reap tens of billions in profit with a single breach.

Exploit programs are the only segment we can accurately quantify and statistically evaluate from the past 23 years, which is why our research data starts here. However, it must be recognized that the time cost of a skilled human hacker permeates every link in the attack chain.

Reconnoitering network topology, fine-tuning attack payloads for the unique hardware and software environment of the target, moving laterally within the internal network, and ultimately completing monetization: each step in the past required dedicated personnel, and the hacker's time was only spent on targets that could yield substantial returns. This is precisely what the so-called “too small to target” meant in the past. Small organizations might not have been immune from large-scale automated botnet scans, but they never had to worry about targeted attacks from high-level hackers, as they simply weren't worth the effort.

Now, however, AI is cutting the cost of every link in this entire attack chain, not merely limited to generating exploit code itself. This is why the two most destructive incidents this fall did not even require any brand new zero-day vulnerabilities: the attack on the freezing systems of hundreds of supermarkets in Europe only targeted outdated industrial controllers that had long ceased to receive firmware updates, with vulnerability details publicly available for months; and the astounding $6.3 billion theft from Binance only involved penetrating a single engineer's personal computer to gain entry.

Figure: Evolution of the time window from vulnerability disclosure to actual attack from 2018 to 2026

Statistics from cybersecurity giant Mandiant show that the average time interval from the public disclosure of a security vulnerability to the first actual attack behavior on the market has plunged from 63 days in 2018 to 2019 to just 5 days by 2023, falling down to 44 days in 2020 to 2021 and 32 days in 2021 to 2022.

By 2024, actual attacks could occur on average a full day before vulnerabilities are disclosed, while in 2025, this window will evolve to an average of 7 days of encountering attacks prior to disclosure.

It is crucial to point out an important era background: the crossover reversal of the aforementioned two timelines occurred before the full explosion of agentic AI. National-level hacker organizations and top ransomware crime groups had already learned to launch targeted clearing against devices exposed on the public internet before the official release of patches.

The truly disruptive variable brought by AI is that it has completely reshaped who is capable of acting within this narrow time window and accelerated the weaponization of known existing vulnerabilities (N-day) at a terrifying scale.

Historical Retrospection: Why Exploits Were the Biggest Bottleneck

An exploit is essentially a piece of computer program that can transform vulnerabilities or logic flaws into system access control permissions. Over a span of twenty years, building such a program has been an extremely expensive and time-consuming fine art.

A classic study by RAND in 2017 on more than 200 real zero-day vulnerabilities found that it took a top professional hacker an average median time of 22 days to construct a stable usable exploit. Intermediaries in the black market priced each available vulnerability from tens of thousands to millions of dollars, and this core R&D skill has historically been monopolized by national intelligence agencies and a few well-funded multinational cybercrime groups.

This insurmountable technical threshold perfectly explains one of the most often cited counterintuitive statistics in the field of vulnerability management: of all publicly disclosed known vulnerabilities in human history, only about 6% have actually been weaponized and used in the wild by hackers. Epoch research analyst Timothée Chauvin attributed most of this significant gap to the fact that past attackers “simply did not have the time to create attack tools for every vulnerability.”

This is also why the open-source penetration testing framework Metasploit did not destroy the internet back then. Metasploit indeed made it incredibly easy to use others' already written attack codes, but at the forefront, top experts still had to hand-write code, manually lock targets, and personally orchestrate attacks. Today, AI agents are taking over all these processes.

During that historical era, the defensive side's defenses also underwent leapfrog upgrades. Microsoft resolutely paused all Windows new feature development for two full months, turning all personnel to security hardening, subsequently launching Windows XP Service Pack 2 with default system firewalls and enhanced patch control.

Cybercrime gradually became professionalized, prompting hackers to prefer maintaining covert access for long-term monetization; Metasploit itself evolved into a core tool for defensive parties to conduct security self-assessments and engage in red-blue team confrontations. These two balancing forces still play a key role today. But the fundamental difference is: back then, Microsoft was able to force an update of the operating system running on the vast majority of computers globally; today, massive systems exposed on the public internet are scattered across tens of thousands of vendors and millions of devices that are no longer maintained.

A more apt historical echo is that time when a previously scarce attack tool suddenly became freely available to the public: EternalBlue. Microsoft released a patch for that vulnerability in March 2017; a month later, the top weaponized exploit code crafted for that vulnerability by the NSA was leaked.

After the official patch had been publicly available for 59 days, the notorious WannaCry ransomware worm emerged, instantly paralyzing 81 out of 236 public hospital trusts in England. Following this, NotPetya caused over $10 billion in devastating economic losses. It is worth contemplating that every victim organization actually had a full two months of ample time to patch before disaster struck.

Before that, it was the worm era spanning from 1999 to 2004. According to historical estimates cited by cybersecurity expert Jason Healey, that series of outbreaks caused direct economic losses exceeding $250 billion when converted to 2025 dollars. It wasn't until Microsoft initiated historical security reconstruction that the calamity was finally contained.

Real Battlefield: Changes on the Cyber Front in 2026

The front-line real battle records since 2026, although brief, provide highly indicative and cautionary examples.

On September 21, an AI agent successfully breached the defenses of the Dutch Institute for Vulnerability Disclosure (DIVD) by combining two zero-day vulnerabilities in order management customer service software. As the agency marveled in their official post-mortem, the privilege escalation within the entire internal network was “completed in seconds,” and the agent “made all tactical decisions autonomously.”

In May of this year, Google’s threat intelligence team disclosed the first zero-day exploit program used in the wild by criminals, which was originally intended for large-scale automated cyberattacks, but fortunately intercepted before formal deployment. In August, the NSA, CISA, FBI, Energy Department, and EPA jointly issued an urgent security alert, warning that hackers were using AI-generated scripts to launch widespread probing attacks against Siemens industrial controllers deployed in energy, water, and chemical plants exposed to the public internet. The alert did not mention any brand new vulnerabilities; the only change it pointed out was that those old, publicly known security hazards were now fully endowed with automated attack capabilities.

Furthermore, industrial cybersecurity giant Dragos disclosed and documented a severe intrusion event: an attacker used a cutting-edge large model as their “chief technology officer,” autonomously coding a customized attack framework of over 17,000 lines of code, successfully penetrating the office internal network and industrial control system boundary of a water company in Mexico, and was only narrowly intercepted by the defense system at the last moment.

These incidents, although they have not yet caused systemic disasters, the storm surrounding the PHP vulnerability proves from both sides how fragile the current balance is. A week after the vulnerability was disclosed, millions of automated attack attempts ultimately only confirmed a few successful intrusions: memory corruption type vulnerabilities are extremely difficult to exploit 100% reliably in practice, and major cloud service providers and CDN deployed interception rules at the network edge within a single day.

However, simultaneously, there are still 2.6 to 4.4 million PHP services exposed on the public internet, of which about 80% run on official old versions that have long since ceased to be supported, and hundreds of thousands that have no patches available at all. They mostly consist of outdated blogs or micro-enterprise websites that have long been neglected, and hackers would never have devoted effort to target them in the past. But this is precisely the crux of the issue: when the cost of attack approaches zero, hackers don't need to deliberately choose their targets; every compromised site will naturally become a stepping stone for the attackers to launch phishing campaigns, deploy poison, or execute the next large-scale attack. Unlike the Y2K crisis, this security risk does not simply disappear after a specific date.

Skill Leap: Why Attack Evolution Has Suddenly Accelerated Now

The research results from top AI laboratories provide an underlying explanation for the changes we are seeing on the front lines. Most of this data is derived from tests conducted by AI developers themselves and operates in an ideal testing ground without real-time human defender opposition, hence we regard it as a mechanism explanation rather than directly equating to real battle conditions.

In March 2026, Anthropic reported that after hundreds of attempts and around $4,000 of computational expense, their then-current model successfully generated two fully usable exploit programs for real vulnerabilities in the Firefox browser. Just a month later, their next-generation unpublished model produced a staggering 181 usable attack payloads for the exact same task at once. By June, Anthropic further announced that it took less than 1 hour for the model to generate usable attack code from obtaining official vulnerability patches' comparison code; and, in the absence of any source code, solely using the Windows kernel binary, the model generated 8 complete local privilege escalation exploit chains in just 18 hours at an extremely low cost of about $2,000 each.

Completely independent third-party empirical evaluations also point to the same conclusion: long-term tracking by the UK AI Security Institute (UK AISI) indicates that the maximum duration for cutting-edge large models to independently complete cyber attack and defense tasks doubles every 4.7 months; in May of this year, the Institute officially recorded the first large models capable of autonomously navigating through their 32-step enterprise internal network targets and industrial control network targets.

Figure: UK AISI and METR testing showing that the duration for large models to complete cyber attack tasks doubles every 4.7 months

Cybersecurity is by no means the only exception. Since the end of 2024, the maximum task duration that large models can stably and reliably deliver in the fields of cybersecurity and software programming has maintained an astonishing pace, doubling every 4 to 5 months. The developmental trajectory in software engineering has already revealed a future scenario to us: in less than two years, programming agents have rapidly penetrated 83% of large enterprises and entered actual production pipelines from primitive, rudimentary laboratory demonstrations.

Figure: Comparison of time taken by top human experts and AI large models from vulnerability discovery to constructing usable attack payloads

In short: the cost of constructing an exploit payload has collapsed from a month's labor by top human experts to just a few hours of cheap machine calculations; a known vulnerability (N-day) that has just received a patch can now be automatedly weaponized even before security supervisors at many institutions have a chance to read the official security announcement.

Stagnant Defense: The Physical World's Patching Period Remains Unchanged

As early as 2003, Qualys quantified the “half-life” (the time needed for affected enterprises to repair half of their exposed systems) of major security vulnerabilities, concluding that it was 30 days. By 2008, this figure remained unchanged at 30 days.

According to the latest 2026 Verizon Data Breach Investigations Report (DBIR), the median repair time for enterprises addressing known exploited vulnerabilities in the wild has climbed to 43 days, up from 32 days the previous year, with only 26% of systems able to complete repairs within an entire year. Ironically, in this same year, exploitations of vulnerabilities officially surpassed phishing credentials to become the primary source of data breaches on the internet.

In the vast downward world beyond large enterprises, the pace of patching has further slowed or come to a complete halt: in the industrial control system security notice released in 2025, a full quarter had no usable repair patches at the time of manufacture; grid operators are permitted by regulatory regulations to reserve up to 35 days to assess the safety of patches and then enjoy another 35 days to implement them; while the FDA's directives on medical device cybersecurity legally only cover newly manufactured devices.

Even at the pinnacle of the tech pyramid with the most robust technical resources, the last mile of vulnerability patching remains muddy. In October of this year, Anthropic reported that their unpublished large model successfully wrote attack code capable of allowing unauthorized remote hackers to take complete control of servers through a race condition vulnerability in the Linux kernel's multipath TCP module. However, well over three weeks after the upstream open-source kernel had integrated the fix on October 5, the two most mainstream server distributions, Ubuntu and Red Hat, still had not pushed the fix installation package to users; Red Hat initially even evaluated this vulnerability as only “medium severity,” reasoning that “race conditions are difficult to trigger accurately in reality.” As a result, the large model was able to complete an exploit in under an hour. Today's security rating system still clings to the outdated assumption that “attackers are human.”

Decision-makers in enterprises are well aware of this. In a recent survey of 100 security heads of large multinational enterprises released by our colleagues, a CISO of a fintech company bluntly pointed out: “You indeed find vulnerabilities at an accelerated pace thanks to AI, but your speed of patching vulnerabilities hasn’t noticeably improved.”

Cautiously Optimistic: Why We Do Not Believe It Will Lead to Systemic Destruction

Let's start with the power grid, as this is deeply feared in the public's imagination of cyber warfare. However, cutting off the power supply to a national grid requires far more than mere system intrusion access.

The grid scheduling system uses specially designed obscure industrial control protocols, equipped with relay protection hardware that is completely independent of software and designed to block the spread of faults based purely on physical mechanical principles, and in extreme cases, can seamlessly switch to purely manual physical operations. In every recorded successful grid attack (e.g., the Ukrainian grid attacks in 2015 and 2016), it required a national-level elite hacking team to spend months conducting precise on-site reconnaissance and tailor-made attack firmware for specific power stations, and power restoration was entirely managed by humans within hours. Large US electric utility companies operate under stringent federal reliability standards, with extremely strict physical network segmentation and mandatory patching regulations.

For sovereign nations, the greatest constraint in launching strategic attacks on the grid has never been a lack of exploit code, but rather political intent and the willingness to bear the catastrophic geopolitical consequences of an ensuing real war. According to a CISA survey, some nation-state hackers had quietly lurked within the internal networks of certain US critical infrastructures for at least five years, yet having access did not equate to choosing to trigger destruction.

The truly concerning uncontrollable variables lie with those extremist destructive forces that have no geopolitical reservations: extreme hacker activist groups, terrorist organizations, and peripheral agents used by major powers to evade responsibility. The core shortcoming that held this segment of fanatics back in the past was never intent, but ability; a lack of deep engineering accumulation to transform digital control over into physical destructive effects. But this is precisely the gap that AI is rapidly narrowing.

Technological capabilities of open-source weight models are typically only lagging behind the top closed-source models by a few months to a year, and “jailbroken” models that exclude security rejection mechanisms are no longer exclusive to the dark web: the open source community Hugging Face hosts thousands of relevant variants, and since September, several startups have publicly sold top-tier open-source large model cloud APIs that have removed alignment restrictions. The engineering industry broadly believes that while forcibly removing safety rails may slightly compromise certain reasoning accuracy, it can in no way hinder this trend's evolution. We must be clear-headed enough to assume: within the next year, a large model that is not subject to any security constraints will possess all the capabilities exhibited by today’s most compliant models: independently discovering vulnerabilities, reverse-engineering attack payloads from patch differences, autonomously moving laterally within internal networks, and operating autonomously for weeks without human intervention.

In reality, instances of exposed control devices suffering malicious destruction are no longer rare: In January 2024, a pro-Russian hacker group caused a severe overflow in the water tower of the city of Marsha in Texas by tampering with pump control parameters; in April 2025, another hacker group forcibly opened the floodgates of a dam in Norway for four hours; by the end of 2023, a group linked to specific geopolitical forces directly seized the water control devices of dozens of water plants across the US through default passwords. Each compromised target was a small public utility site exposed on the internet, and each instance of destruction has been measured in minutes or hours of localized disturbances, never escalating into large-scale malevolent supply cuts. We anticipate that in the future, attackers with stronger AI weaponization capabilities will unleash more frequent harassment strikes against these defenseless small public facilities.

However, the reason we still ascertain that the backbone grid will not face a complete breakdown is not that these attack groups are merciful, but rather that modern grid architecture was inherently designed to absorb significant accident losses through physical redundancy and resilience. The physical tripping protection mechanisms of grids rely on voltage and current physical laws, rather than code operating on an operating system, and the entire grid has undergone long-repeated training for black start recovery processes. This robust framework that has withstood attacks by national-level military forces can also withstand any tidal wave from external AI attackers. The true destructive power of unrestrained malicious actors will still focus on the long-tail systems that lack redundancy.

Meanwhile, the overall robustness of the internet far exceeds that of its weakest singular server. Most of today's internet traffic, upon which humanity relies, is hosted by a few massive cloud computing, CDN, and hosting service providers that have update speeds reaching machine-level milliseconds. During the outbreak concerning PHP vulnerabilities, these core service providers set up dynamic interception rules at the network's edge for millions of hosted sites within a single day. The global core routing protocols (BGP) and the domain name resolution system (DNS) are highly centralized and are under constant tight control by top-tier professional teams known as "the top 1% of the security field."

Looking through history can also confirm this: the worm era repeatedly swept across the entire internet, but the internet has never completely interrupted service; NotPetya wreaked havoc, causing over $10 billion in damage and halted operations of multinational shipping giants and pharmaceutical companies for weeks, yet the entire internet continued to function normally. Today's macro statistics also do not present a trend toward systemic collapse: the number of vulnerabilities confirmed to be exploited in the wild moderately rose from about 640 in 2023 to 880 in 2025, but during the same period, the overall number of publicly disclosed vulnerabilities surged by two-thirds; actual ransomware payments have declined for the second consecutive year; among the 440 compromised institutions from the PaperCut printer vulnerability attacks, only 12 completely lost control of their internal networks.

Figure: Annual increase in total public CVE vulnerabilities versus actual vulnerabilities exploited in the wild

Within the current evolutionary pattern, there are two significant structural risks that require our heightened vigilance:

The first major risk is the uncontrolled spillover expansion of attack behaviors. In the aforementioned PaperCut case, the AI agent directly disregarded the geographical geofence white list set by the operator, and in another experimentally controlled environment, about 1,200 originally completely isolated agents spontaneously explored collaborative sequences, of which about 700 agents independently joined unauthorized coordinated attack actions. Just as the gravest losses caused by NotPetya were entirely collateral damage, the unpredictability of AI agent behaviors can easily break preset boundaries.

The second major risk is the resonance of multi-point concurrent aggregations: the massive spread of national-level attack capabilities to more civilian entities will completely break down defenses that could previously only deal with low-level hackers, including micro water supply systems in remote areas, rural electric cooperatives, and county-level grassroots hospitals. Highly coordinated multi-point concurrent attacks, especially those aimed at pure physical destruction through malicious wiping codes, can transform countless dispersed minor faults into a regional major public crisis within a short time.

A series of coordinated attacks against physical facilities across several European countries in October this year has already sounded the alarm for us. Hackers simultaneously manipulated the commercial refrigeration control systems of hundreds of large French supermarkets, maliciously raising temperatures and even deliberately setting fires, leading to massive food spoilage; three weeks later, supermarkets in Belgium, Luxembourg, Sweden, and Estonia experienced similar attacks, with some freezers' temperatures forcibly altered to 50°C.

The French national security agency had previously clearly warned operators, urging them to completely disconnect these outdated controllers from the public internet and cautioned that these devices, lacking subsequent technical support, would still remain riddled with vulnerabilities even if factory settings were restored. Although this case has yet to be confirmed as directly involving AI, the attack paradigm displayed is highly representative: simultaneous outbreaks in multiple countries overnight, spanning across hundreds or even thousands of physical locations.

The issues exposed by the second wave of attacks closely target the core issues of this report: a full three-week advance warning period was simply insufficient for offline physical maintenance teams to complete on-site repairs. For physical facilities that need to rely on human personnel running to the scene to complete repairs, even if online vulnerability reports are released in a matter of seconds, it does nothing to shorten the actual handling time on the ground.

Long-Tail Strangulation: No Institution is Immune to Being Victimized for Being Small

The trauma caused by this technological reshuffle will be unevenly distributed among all levels of society. Those long-tail small organizations who have relied on cybersecurity scholars Murphy and Stone's description of “seemingly rational psychological luck (believing that high-level attackers simply do not waste time targeting them)” will now be dragged back into the grinder of attacks by AI at an extremely low cost. In the PaperCut attack event, half of the victim organizations were public primary and secondary schools; in a survey conducted by IoT security agency Claroty involving 351 healthcare institutions, a staggering 89% of connected medical devices had known high-risk vulnerabilities that were being utilized in the wild, and were long exposed to unprotected internet connections. Attackers do not need to crack the complex imaging algorithms within an MRI machine; they merely have to prevent that machine from starting up normally, which is enough to completely paralyze a hospital's operations.

Figure: The number of ransomware victim institutions continues to surge while actual ransom payment totals gradually decrease

The changes in the flow of funds in the global black market have clearly evidenced this historical shift: the number of victim enterprises reported on ransomware data leak dark web sites has surged over fifty percent year-on-year, whereas the total ransom actually received by hackers has dropped to about $820 million. Attack numbers have skyrocketed, while the revenue has declined: extremely low-cost automated penetration has cast a wide net over previously neglected small and micro-victims, the vast majority of which are unable to pay high ransoms. The Verizon report indicates that ransomware accounts for as much as 88% of security incidents in small and micro enterprises, whereas it only accounts for 39% in larger enterprises. The black market price of internal network access credentials has also plummeted: Chainalysis data shows that the average price of buying an internal network access credential from a victim enterprise on the black market has fallen from approximately $1,427 at the beginning of 2023 to just $439 at the beginning of 2026.

We clearly anticipate that the breakeven point for ransomware attacks will fully penetrate into the sinking market, reaching down to dental clinics, municipal agencies in county-level cities, and micro-manufacturing plants. After breaching systems, attackers may not even need to rely on victims to pay a ransom; simply selling the internal network credentials or stolen commercial privacy on the black market would be enough to turn a profit; while nation-state hackers and extreme activists can leverage this cheap weapon without considering commercial returns. Meanwhile, the high homogeneity of open-source components has brought strong correlation risks: a single vulnerability in universally shared underlying code can instantly expose thousands of businesses to risk. As purely destructive attacks aimed at wiping systems become rampant, merely tracking ransomware payment amounts can no longer accurately measure the true social losses. A devastating wiper program never demands a cent in ransom; we should closely monitor the overall increase in the number of victims and the duration of business interruptions they face.

Figure: The frequency of ransomware attacks faced by the global healthcare industry and the trend of average business down time in weeks

The crisis of stagnation facing healthcare institutions most intuitively reflects these long-tail costs. Even before the advent of generative AI, hospitals that experienced ransomware attacks had an average core business downtime of two to three weeks, while the number of confirmed attacks faced by global healthcare systems surged six-fold from 2018 to 2024. Including unverified data from dark web leak platforms, the number of attacks against healthcare institutions in 2024 and 2025 remained high at about 440 per year, while in the first nine months of 2026 alone, the total number of attacks equaled that of the entire previous year, with the third quarter reaching an all-time high of 192 attacks in a single season. Recovery from disasters is also becoming increasingly complicated: attackers are encrypting the main production database while specifically targeting backup systems to block victims from self-recovering. If data backups are completely wiped, previous weeks of business interruption can stretch into months.

The long-tail ecosystem is not the only front to suffer profound pain. Security exposures will forever follow all existing systems that cannot achieve automatic hot updates at machine-level speeds, regardless of how robust their owners' budgetary barriers may appear on paper. On the other end of the scale sit the extremely few super targets, whose loss is sufficient to trigger seismic ripples across entire sectors. Binance Exchange ultimately classified the heist it suffered on October 29 as a staggering $6.34 billion loss; preliminary investigations revealed that the attack penetrated the working machines of core engineers to steal signature privilege credentials. Within hours of the incident, two major lending protocols were forced to urgently freeze markets used by hackers to monetize, triggering liquidations worth up to $628 million across the entire network. On the same day, a malicious imitation of the Claude Code extension plugin, secretly implanted with a backdoor, remained listed in the official Cursor plugin market for approximately 11 hours, quietly invading the developer machines of up to 5,000 core software engineers in an effort to preemptively implant SSH remote backdoors. Cursor promptly took down the plugin and completely restructured the security access mechanisms of the plugin market, but how the malicious code successfully bypassed the auditing process for listing remains an unresolved mystery.

Breakthrough Watershed: Who Can Escape by Patching, Who Cannot

Faced with attackers evolving at machine speed, the industry's most instinctive muscle memory is demanding that defenders accelerate their patching pace. This strategy is indeed effective under certain specific architectures, but in other systems, it is entirely wishful thinking; the inherent divide between the two fundamentally depends on the economic and operational costs of a single software update.

Figure: Patching cost versus downtime risk matrix for different types of systems

This introduces two radically different fateful forks: real-time patching at machine speed can only occur in areas where update costs are extremely low and rollback fault-tolerance costs are similarly minimal: multi-tenant SaaS software hosted by providers in the cloud, modern mobile operating systems and web browsers that can be silently updated in the background, and high-availability reverse proxy clusters deployed at the edge of large supercomputing networks that can intercept attacks in real-time with uniform rules. However, in realms where updates mean having to completely halt physical industrial assembly lines, require stringent regulatory re-approval for critical medical devices, or even where device owners are unaware of the physical existence of public network connections, discussing rapid patching becomes impractical.

Moreover, even if all parties strive to hasten the patching process, in physical reality, there exists an insurmountable fatal ceiling for the speed of patching. If every tiny security patch requires all core servers to be fully pushed within minutes, this insane frequency of change itself can evolve into a massive suicidal downtime disaster: in July 2024, security giant CrowdStrike caused about 8.5 million Windows terminals across the US and globally to crash into blue screens and paralyze global air traffic for several days, merely due to pushing a single flawed underlying update. Once the frequency of patching crosses a certain threshold, the patching actions taken by defenders to avoid hacker attacks can directly transform into long-cycle unplanned downtimes created by their own hands. For all critical entities and infrastructure located in the lower right quadrant of the axes, the ultimate security defense must shift from passively awaiting patch code to actively employing end-to-end network topology isolation, refined segmentation controls, and stringent edge suppression measures to ensure that vulnerabilities are physically unreachable from the public network and that a reliable manual mechanical emergency bottom line remains intact even in the worst-case scenarios. How this layered defense system will practically be implemented is the core theme we will delve into in our next report.

Future Sandbox: Validating Our Core Indicator Scorecard

Figure: Future trend scorecard for core indicators of cyber attack and defense in the AI era over the next two years

Judgment Revisions: What Signals Would Overturn Our Conclusions

The true trajectory of technological evolution will become clear within the next two years, as all core validation indicators are publicly transparent and measurable in the public network:

Indicator One: Total number of vulnerabilities exploited in the wild. VulnCheck monitored approximately 880 actual exploited vulnerabilities in 2025. If this figure remains below 1,200 by the end of 2027, it would prove skeptics are correct, that the cost drop has not led to a real explosion of attacks; conversely, if this figure breaks through 2,000, it would signify the irreversible collapse of vulnerability weaponization costs. As a reference coordinate, if we apply the historical average conversion rate of 6% to the total number of newly public vulnerabilities in 2025, theoretically this should correspond to about 2,900 exploited vulnerabilities, equivalent to eight new ongoing exploitations daily.

Indicator Two: Actual in-the-wild utilization ratio of vulnerabilities on the day of disclosure. In 2025, a full 29% of vulnerabilities subjected to wild attacks were impacted even before the official CVE number was released. If this percentage surges to over half by 2027, it would indicate the defensive side's theoretical “patching time window” has been completely closed off unilaterally by the offensive side.

Indicator Three: Median time to repair vulnerabilities in enterprises. The current industry median recorded by the Verizon DBIR report stands at 43 days. If this number successfully drops below 30 days in the 2028 report, it would signify that the defense system, under the empowerment of AI, has successfully automated its self-reformation; conversely, if this cycle extends to over 60 days, it would indicate that the entire societal defense side has been completely left behind in the wake of the times.

Indicator Four: The proportion of vulnerabilities discovered by AI that were maliciously exploited in the wild. Thus far, only 1.3% of all new vulnerabilities detected by AI have ultimately been weaponized by hackers in the wild. If this percentage remains below 5% before the end of 2027, it indicates that the benefits from AI’s vulnerability discovery have been more utilized by the defensive side to strengthen their walls in advance rather than being preemptively abused by the offensive side.

Indicator Five: The breadth of victim groups affected by ransomware attacks. The victim lists published on ransomware dark web platforms shot to a historical high in 2025. If the total number of victims continues to surge in the future while the total ransoms paid by victims keep decreasing, it will thoroughly validate our core argument: hackers are launching indiscriminate sweeps against small long-tail institutions unable to pay ransoms thanks to their inexpensive automated attack capabilities.

Indicator Six: Physical destruction events of industrial infrastructure. Large-scale multinational physical destruction is already occurring without clear attribution: hundreds of French supermarkets lost temperature control overnight in October, with further mishaps occurring in four European countries on November 1. If by the end of 2027, no instances of physical facility attacks conclusively identified as being carried out via AI automation tools emerge, it will prove that within heavy asset industrial control systems, there remains a daunting divide between “mastering system vulnerabilities” and “actually causing physical destruction.”

Indicator Seven: The structural ratio between purely destructive attacks and economic ransomware attacks. If by 2027, significant security incidents aimed at directly wiping data or physically damaging devices starkly increase among attacks across the network, it would indicate that boundless attackers, unconcerned with economic returns, have fully entered the scene, and traditional metrics of ransom statistics would severely underestimate the real-world comprehensive losses.

The empirical history of 23 years of offense and defense tells us: simply relying on software vulnerability patching alone, the defensive side cannot possibly keep pace with the evolutionary steps of attackers. Back then, Microsoft was able to protect a majority of global internet users by quickly reconstructing the Windows system; today, no single tech giant can solely bear the burden of this mess. Our core assessment for the future situation is: 2026 will not evolve into a globally disruptive war akin to a sci-fi movie; rather, it will resemble the prelude to a long, expensive, and exceedingly tormenting grand worm era. This sword of Damocles will hang above every long-tail victim lacking the protection of large cloud platforms, and will be tightly locked onto the very few crown jewels whose value is high enough to warrant violent dismantling of the cloud platform itself.