New Moody’s research says half of known exploited software flaws are still open after about three months, and the ratings agency treats that delay as a credit risk. If your organisation borrows money, buys insurance or sells to large buyers, patching speed is now a balance-sheet issue as well as a technical one.
What happened
On 19 October 2026 Infosecurity Magazine reported on new research from Moody’s Ratings that measures how quickly organisations fix vulnerabilities attackers are already using. According to Infosecurity Magazine’s report on the Moody’s research, the median time to remediate a known exploited vulnerability is 87 days. That means half of these flaws are still unpatched after roughly three months. Vulnerabilities with no known exploitation fare worse, with a reported median of 107 days.
The figures are built on telemetry from Bitsight Technologies, collected in February 2026 and covering flaws disclosed over the preceding two years. Moody’s itself flags the age of the data. AI offensive capability has advanced since then, so both exploitation and remediation timings may have shifted.
The credit framing is the point that matters for business readers. Moody’s argues that organisations with weak patching discipline carry the highest credit risk. It also warns that smaller firms may look more attractive to attackers as AI lowers the cost of an attack.
The detail
This is not the first time Moody’s has linked patching to creditworthiness this year, and the earlier work helps put the new numbers in context. In May, SecureWorld covered a Moody’s report that drew on Bitsight data covering around 9,500 issuers. That report found 60% of organisations had at least one known exploited vulnerability visible from the internet during 2025, and a quarter had a verified one left unpatched for more than a year. It also put the average gap between public disclosure and first exploitation at 44 days, against the 21-day window CISA sets for most entries in its Known Exploited Vulnerabilities catalogue.
A Moody’s banking report covered by Investment Executive and Cyber Magazine around the same time used the same comparison. Attackers were exploiting flaws in about 44 days on average, while the median fix took 69 days in banking and 87 days across sectors. Investment Executive quoted Moody’s describing that gap as a source of “structural credit risks for banks, not incidental ones”.
The new research, as Infosecurity Magazine describes it, adds an AI dimension. It points to rising vulnerability volumes driven by AI-assisted discovery, with Microsoft having broken its own record for fixes in three consecutive Patch Tuesday releases. It also cites containment failures during developer testing at OpenAI and Anthropic as evidence that AI agents can already find and exploit weaknesses within days. Moody’s notes that OpenAI’s case was an internal evaluation, and that no criminal operation of that size has been reported publicly.
The UK link is direct. According to Infosecurity Magazine, Moody’s draws on a UK AI Security Institute estimate that open-weight models now trail frontier models in offensive cyber capability by only four to seven months. Moody’s expects today’s barriers to fully autonomous attacks, such as compute cost and restricted model access, to be temporary.
Why it matters for UK organisations
When a ratings agency treats a security metric as a credit input, that metric starts to show up in places security teams do not usually look. Lenders and investors read Moody’s commentary. Cyber insurers already ask about patch cadence at renewal. Large customers, especially in financial services and critical infrastructure, push the same questions down their supply chains. A slow remediation record therefore stops being an internal IT statistic and becomes something a finance director may have to explain.
The warning about smaller firms deserves particular attention in the UK, where SMEs make up the bulk of the economy and many rely on a single managed service provider for patching. If AI makes it cheap to scan for and exploit known flaws at scale, the old assumption that a small business is too insignificant to target no longer holds.
There is also a regulatory overlap. The Cyber Security and Resilience Bill will widen the range of UK organisations with incident reporting and security duties, and boards are being asked through the government’s Cyber Governance Code of Practice to take ownership of cyber risk. Evidence that an exploited flaw sat open for three months is not something any director wants to see in an incident report.
Expert view
None of this will surprise anyone who does infrastructure testing for a living. In my experience the problem is rarely that a team does not know a patch exists. It is that the vulnerable system is an edge appliance nobody owns, a legacy server tied to an application that cannot be restarted in business hours, or a device managed by a third party under a contract that never mentioned service levels for security fixes. When we test externally, the findings that get us in are usually the ones already sitting in the KEV catalogue, not exotic zero-days.
What has changed is the value of time. A 44-day exploitation window against an 87-day remediation median was already a losing position. If AI tooling compresses the attacker’s side to days, the arithmetic simply stops working for anyone running a monthly or quarterly patch cycle on internet-facing kit. The long tail of flaws left open for a year or more is where the serious compromises tend to come from.
The Moody’s framing is useful because it gives security leaders language finance colleagues understand, tying budget requests to cost of capital and insurability rather than severity scores alone.
What to do now
- Measure your own number. Calculate median and 90th-percentile time to remediate for flaws in the CISA KEV catalogue across your estate, split by internet-facing and internal assets.
- Set a fast lane for exploited flaws. Treat anything newly added to KEV on an internet-facing system as an emergency change, with a target measured in days. Cyber Essentials requires high and critical updates within 14 days; aim well inside that at the perimeter.
- Close ownership gaps. Make sure every firewall, VPN, remote access tool and file transfer appliance has a named owner and an asset record. Unowned edge kit is where long-tail exposure hides.
- Fix the contracts. Review MSP and supplier agreements for explicit security patching timelines and reporting. Ask for remediation metrics, not just uptime figures.
- Reduce what is exposed. Remove management interfaces from the internet, retire unsupported systems, and apply the secure configuration and boundary firewall controls in Cyber Essentials so that slow patches matter less.
- Report it upwards. Put exploited-flaw exposure time on the board risk dashboard alongside insurance and financing discussions, so that patching investment is judged against its effect on credit and premiums.
Bottom line
Moody’s is saying out loud what defenders have known for years: attackers move faster than most organisations patch, and AI is widening the gap. The difference is that the message now comes from a credit rating agency, so it reaches finance directors as well as security teams. UK organisations that can show a short, well-managed exposure window on exploited flaws will find that evidence increasingly useful with insurers, lenders and customers.
Sources
- Infosecurity Magazine: Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
- SecureWorld: Corporate Perimeter Hygiene Lags Behind AI Threats, Report Shows
- Investment Executive: Financials facing mythical threat
- Cyber Magazine: Moody’s Warns that AI Cyber Arms Race Raises Risks for Banks
