← This is worth your attention

1 MIN READ SIGNAL

Bain: AI Attack Speed Turns the Vulnerability Backlog Into an Ownership Problem

AI has compressed the typical attack timeline from roughly four weeks to about 18 hours, according to Bain’s Technology Report 2026. Reconnaissance dropped from 168 hours to one hour, and lateral movement from 168 hours to three. Defenders are not getting the same speedup on the remediation side, and that is the actual problem.

The bottleneck is the backlog. AI-powered scanning can raise vulnerability alerts by up to eightfold, which swamps remediation processes built for a slower era. More than half of vulnerabilities sit outside critical applications, in legacy platforms, APIs, and authentication systems, so the alerts that pile up are often in the systems nobody prioritized. The hardest exposures, Bain finds, are legacy platforms, network layers, and third-party SaaS.

Leading companies have already moved money and people. They raised remediation budgets by double-digit percentages and redirected as much as 20 to 25 percent of security staff to clearing alerts. One organization tripled its remediation team.

Bain’s authors, Syed Ali, Frank Ford, Matthew Leybold, Alexandra Juegelt, and Dana Aulanier, list six priorities:

  1. Scan beyond critical systems.
  2. Build remediation capacity alongside scanning.
  3. Retire vulnerable technical debt.
  4. Make executives accountable for vulnerability debt.
  5. Give boards granular monthly or weekly metrics.
  6. Commit to multi-year investment in talent.

Only the first item is a tooling decision. The other five are operating-model choices: who owns the debt, who sees the numbers, and who is funded to close findings. That is why buying a better scanner without staffing the fix queue makes the problem worse — it raises the alert count and leaves the remediation rate where it was.

The practical test for any leadership team: take last quarter’s vulnerability findings and ask how many were closed, by whom, and how long each took. If nobody at the executive level can answer, the gap Bain describes is already yours.