AI-Powered Cyberattacks: The Patch Window Is Shrinking

AI-powered cyberattacks can now scan for and exploit security flaws much faster than before. On 9 October 2026, ITSEC Asia warned that manual processes alone are no longer enough. For schools, government offices, and companies in Indonesia, that means one thing: the time you have to patch a vulnerability keeps getting shorter.

What industry voices said this week

At a press conference in Jakarta on 9 October 2026, ITSEC Asia President Director Patrick Dannacher said cybercriminals are starting to use AI to automate attacks, including scanning systems for weaknesses faster and at larger scale. According to Suara.com, traditional approaches built on manual processes are considered inadequate, so companies need automated defenses that respond as quickly as the attacks do.

The remarks came ahead of the AI & Cybersecurity Executive Forum (AICX) 2026. ANTARA reports that the forum takes place on 20 October 2026 in Bali as part of Bali Tech Week, with around 600 C-level leaders and senior decision makers attending.

One honest caveat: neither article includes investment figures or quantitative projections. Read this as a signal of where the industry is heading, not as hard statistics.

The gap between a flaw being found and being exploited

Every day, researchers and vendors disclose new vulnerabilities. Each gets a CVE number (Common Vulnerabilities and Exposures), basically an ID card for a security flaw. Once a flaw is public, the vendor usually ships a patch, and the organizations using that software need to install it.

The time between disclosure and installation is the exposure window. It used to be fairly forgiving, because attackers needed time to understand a flaw and write working attack code. AI speeds up exactly that work.

Fortinet’s 2026 Global Threat Landscape Report, covered by ISMG on 2 June 2026, says attackers using AI and automation can exploit critical flaws in roughly 24 to 48 hours. The report is based solely on Fortinet’s own FortiGuard Labs telemetry, so treat the figure as one vendor’s view rather than a universal benchmark.

Synack’s 2026 State of Vulnerabilities report, reviewed by Help Net Security on 18 May 2026, points the same way: the gap between discovery and exploitation is now counted in hours. Meanwhile, 48,244 CVEs were published in 2025, up 20 percent from the year before.

Automation does not stop at one vulnerability

According to the Fortinet summary above, AI is used across many stages of an attack: reconnaissance, phishing, credential theft, and movement inside a network. Offensive AI frameworks are also described as easier to find on the dark web, which lowers the bar for newcomers.

Picture a regional agency with a service portal that rarely gets updated. Attackers once had to hunt for it by hand. Today a scanner can sweep thousands of addresses at once, then try passwords that leaked earlier against employee accounts. That is why patching is only one layer. Unique passwords and two-step verification still need to run alongside it.

The good news: organizations are patching faster

It is not all bleak. The same Synack data shows average remediation time falling from 63 days in 2024 to 38 days in 2025, about 47 percent faster across all severity levels. Critical vulnerabilities were fixed 25 days sooner.

Still, compare the two numbers. If attackers move in days while the average fix takes weeks, a large gap remains. That gap is what needs closing, and it rarely takes one fancy tool. It usually takes habits: knowing which assets you own, knowing which ones carry the most risk, and having a short chain of decisions.

The Indonesian context: many attacks, regulation on the move

detikInet on 30 August 2026 cited an AwanPintar.id report recording at least 16 cyberattacks per second in Indonesia during the first half of 2026. That comes from a single report, and not every attempt is a successful breach, but it shows that anything connected to the internet is constantly being knocked on.

On the regulatory side, the same article notes growing compliance pressure from Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (the Personal Data Protection Law, or UU PDP) and the cyber security and resilience bill now under discussion in the DPR (House of Representatives). If you handle student, employee, or customer data, leaving old vulnerabilities open will get harder to justify.

We have covered another side of this problem before: old leaked data being resold. The two topics connect. Leaked data supplies the raw material, and AI automation supplies the speed.

What this means for your organization

You do not need to be a bank or a ministry to be affected. A school website, an attendance app, or an agency portal that missed an update is just as interesting to an automated scanner. Here are realistic steps.

List your internet-facing assets. Websites, apps, VPNs, admin panels, and that old server “only one or two people still use”. You cannot patch what you do not know exists.

Prioritize instead of patching everything at once. Start with flaws reachable from the internet that touch important data, such as a student grades portal or an HR system.

Shorten the approval chain. Many delays are not technical, they are waiting for a signature. Agree in advance that critical patches can go in within days, using a maintenance window everyone has accepted.

Automate what can be automated. Automatic updates for operating systems and common software, scheduled vulnerability scans, and log monitoring. This matches ITSEC’s message: manual response alone will fall behind.

Prepare backups and a recovery plan. No patching is perfect. A tested backup decides whether an incident means one day of disruption or months of lost data.

Do not forget AI tools inside your own organization. Rules for how staff and teachers use AI, including what data may be entered, matter as much as a firewall.

If you want to assess weak points or draft a patching routine that fits your size, our team offers cybersecurity services. For safe AI use at work, see our artificial intelligence services, and for government agencies, our digital government solutions.

Frequently asked questions

Are AI-powered attacks only a threat to large companies?

No. Automated scanners do not pick targets by size. They look for open doors. Small organizations are often easier to reach because updates get delayed and there is no dedicated security team.

How quickly should critical patches be installed?

There is no single number for everyone. As a rule of thumb, faster is better, and for critical internet-facing flaws, aim for days rather than weeks. What matters most is writing that target down and measuring it.

Does AI only help attackers?

No. Defenders use AI too, to spot suspicious patterns and respond faster. Fortinet and ITSEC both encourage automated defense, but tools still need processes and people who know how to use them.

Closing thoughts

News about AI and cyberattacks can sound scary. The lesson is simpler than it looks: speed is now part of security. Start with an asset list and one consistent patching habit, such as a 30-minute weekly review of pending updates. Small routines usually beat big projects that never finish. If you would like a relaxed conversation about the state of your systems, feel free to contact us.

Sources

• Suara.com, “AI Bikin Serangan Siber Makin Otomatis, Investasi Keamanan Siber di Indonesia Diprediksi Melonjak” (10 October 2026)
• ANTARA, “ITSEC gelar AICX 2026 bahas adopsi AI dan keamanan siber di Indonesia” (9 October 2026)
• GovInfoSecurity, “The Fortinet 2026 Global Threat Landscape Report: AI-Fueled Cybercrime Shrinks Exploit Window” (2 June 2026)
• Help Net Security, “AI shrinks vulnerability exploitation window to hours” (18 May 2026)
• detikInet, “Ada 16 Serangan Siber Perdetik di RI, Eset Siapkan Platform Keamanan AI” (30 August 2026)