The AI Era Is Transforming Cyberattacks - Australian Businesses Need a New Defence

Artificial intelligence is fundamentally changing the cyber security landscape, giving cybercriminals the ability to identify and exploit vulnerabilities at unprecedented speed

For Australian and New Zealand organisations, the challenge is no longer simply finding security weaknesses, but closing the window of opportunity before attackers can exploit them.

The growing power of AI in cyber security has been evident for several years. The discovery of vulnerabilities in the widely used Log4j software library in late 2021 (CVE-2021-44228) highlighted the potentially devastating consequences of weaknesses in software underpinning countless business applications. 

More recently, the use of AI to uncover two critical vulnerabilities in the PHP programming language (CVE-2026-109618 & CVE-2026-109619) during October 2026 demonstrated how quickly the threat landscape is evolving. The flaws had reportedly remained undetected for more than a decade, despite PHP being used by approximately seven in ten websites worldwide.

The consequences were significant as Australian government websites, educational institutions, and web hosting providers were among those forced to take services offline while security patches were applied.

Together, these developments point to an uncomfortable reality: attackers are increasingly operating at machine speed, while many organisations are still identifying and addressing vulnerabilities using processes designed for a much slower era.

A gap between discovery and protection

Traditionally, vulnerability management has followed a relatively predictable process. A security weakness is discovered, researchers investigate its implications, software vendors develop a patch, and organisations test and deploy that patch across affected systems.

However, this approach creates two potentially dangerous gaps. The first occurs between the discovery of a vulnerability and the availability of a suitable fix. During this period, organisations may remain exposed even when they know a serious weakness exists.

The second emerges between the release of a patch and its deployment. Testing and operational requirements can mean that critical updates take days or weeks to reach production environments. AI is making both gaps increasingly difficult to manage.

Tools capable of analysing enormous volumes of software code can identify weaknesses far more quickly than conventional manual processes. In some circumstances, the time between vulnerability disclosure and exploitation can be measured in hours rather than days.

For organisations relying on conventional patching cycles, this creates a potentially unsustainable situation. Taking vulnerable systems offline may prevent an immediate compromise, but it can also disrupt customer services and create significant financial consequences. The challenge is therefore to find a way to maintain protection without sacrificing availability.

From vulnerability detection to exposure validation

An important first step is recognising that not every vulnerability represents the same level of risk to every organisation. A software flaw may be classified as critical, but its significance depends on factors including system configuration and whether an attacker can exploit it within a particular environment.

This is where Check Point's Exposure Management Agentic Exposure Validation (AEV) can play an important role. AEV uses AI-driven agents and automated testing techniques to investigate whether identified vulnerabilities are genuinely exploitable in an organisation's specific technology environment. The objective is to establish which exposures present a credible threat and therefore demand immediate attention.

This distinction is important because security teams frequently face thousands of vulnerability alerts, many of which may have limited practical relevance. By identifying exploitable weaknesses, organisations can concentrate resources on the threats most likely to cause damage.

Virtual patching means a faster line of defence

Once an exploitable weakness has been identified, the next priority is preventing attackers from taking advantage of it. This does not necessarily require waiting for a software vendor to release a patch or for internal teams to complete lengthy deployment processes.

Virtual patching provides an alternative by using existing security infrastructure to block attempts to exploit vulnerabilities without modifying the underlying application.

For example, web application firewalls (WAFs) can be configured to identify and reject malicious requests targeting a particular software weakness. Intrusion prevention systems and network firewalls can also enforce rules that restrict suspicious activity or prevent access to vulnerable services.

These controls effectively provide a protective barrier around the affected asset while the permanent software fix is developed and deployed. Its effectiveness also depends on ensuring that new security rules do not inadvertently block legitimate business activity.

A new approach to exposure management

Ultimately, Australian organisations need to move beyond treating vulnerability management as a periodic exercise focused primarily on deploying patches. A more effective approach combines continuous exposure discovery and rapid deployment of protective controls through existing security infrastructure.

Under this model, validated exposures can be mapped directly to appropriate firewall, intrusion prevention, or WAF protections, potentially reducing response times from weeks to hours.

For business leaders, the benefits extend beyond cybersecurity. Faster protection reduces operational disruption and allows organisations to make better use of their existing security investments.

As AI continues to accelerate the discovery and exploitation of software vulnerabilities, the ability to respond quickly will become an increasingly important measure of organisational resilience.

The objective should no longer be simply to patch systems faster. It should be to establish whether systems are exposed, apply effective protection immediately, and maintain business operations while permanent fixes are implemented.