EU Cybersecurity Agency Warns AI Models Cut Vulnerability Weaponization to 15 Minutes

The European Union Agency for Cybersecurity has published a policy report stating that a new generation of frontier artificial intelligence models is changing traditional cybersecurity defense. Such models, equipped with advanced reasoning capabilities, can sharply compress the window between the discovery of a system vulnerability and its weaponization.

In the traditional vulnerability management cycle, there is usually a buffer of weeks or even months from disclosure and proof of concept to actual malicious exploitation, during which security teams can assess the impact, validate patches, and deploy them. The report cites industry monitoring data showing that attackers using automated methods can complete weaponization within 15 minutes of a vulnerability becoming public, with an average of about 72 minutes from initial intrusion to data theft.

The report lists multiple risks. Independent maintainers of large amounts of open-source software face a rise in AI-automated vulnerability reports, while legacy systems nearing or already past the end of technical support are more vulnerable to AI-automated scanning.

The governance adjustments listed in the report include reducing reliance on linear defense mechanisms such as manual review, deferred approval, and periodic patching, and shifting toward an assumption of compromise and zero-trust architecture, shrinking the blast radius through network segmentation and strict privilege isolation. The report also mentions integrating defensive AI tools into the software development lifecycle and security operations centers, using automation for vulnerability triage and emergency containment. The directions listed also include making cybersecurity a core strategic focus of European investment in AI technology, in order to advance the development of autonomous AI defense capabilities.