AI Could Rapidly Increase Zero-Day Vulnerabilities, CrowdStrike Warns

The rapid advancement of artificial intelligence (AI) could soon lead to a dramatic increase in the number of zero-day vulnerabilities, potentially overwhelming organizations' capacity to manage cybersecurity threats, according to Mike Sentonas, president of cybersecurity firm CrowdStrike. Currently, over 100 new vulnerabilities are disclosed publicly each day, a figure expected to grow as AI tools become more potent in identifying software flaws.

Sentonas highlighted that AI systems could drastically reduce the time between the existence of a flaw and its exploitation. This means vulnerabilities could go from undiscovered to weaponized much faster than before, potentially shifting the window of opportunity for attackers from weeks to mere hours. Organizations may struggle to test and deploy patches fast enough without risking critical system outages, forcing difficult prioritization decisions.

Sectors relying on legacy hardware and older systems, such as banking, manufacturing, hospitals, and utilities, are identified as particularly vulnerable. Upgrading these complex infrastructures quickly to address new threats could disrupt essential services. Sentonas anticipates these critical infrastructure providers will be among the first to face this escalated challenge.

To combat this evolving threat landscape, companies will need to increasingly rely on "compensating controls." These measures aim to reduce the risk posed by a vulnerability when a patch is unavailable, including network segmentation, access control, and continuous monitoring for exploitation attempts. While AI can assist in implementing these controls, Sentonas stressed that organizations cannot outsource risk and must retain ultimate responsibility for their own networks and security.