AI reshapes the threat landscape as attackers exploit vulnerabilities faster
Artificial intelligence is accelerating the exploitation of vulnerabilities and reducing the time organizations have to fix them, even when dealing with flaws that have been known for years.
By: Martín Hoz, Senior Vice President of Pre-Sales Engineering at Fortinet Latin America and the Caribbean.
Every October, Cybersecurity Awareness Month brings us back to basics. This year, those basics carry a new sense of urgency. Artificial intelligence has simplified something that once required time and expertise: finding, testing, and exploiting weaknesses in code, configurations, or processes that were already in place. Many of these weaknesses have existed for years, and patches have even been available but never applied.
Fortinet’s 2026 Global Threat Landscape Report, published by FortiGuard Labs, puts it directly: AI-powered offensive tools compress the time needed to validate and exploit existing exposure, making it possible to accomplish in less than 24 hours what previously took weeks or months.
In a region where exploitation attempts increased by nearly 40% in one year, this should help set priorities for every security team.
Old vulnerabilities do not expire.
We tend to treat vulnerabilities as news: they emerge, a patch is released, and the risk is considered gone. But FortiGuard Labs telemetry tells a different story.
According to the report, the persistence of exploitation—that is, the length of time an attacker remains inside a network without being detected—is more closely related to how long an organization takes to apply patches or adjust configurations than to how recently the flaw was discovered. Once a vulnerability becomes part of attackers’ automated workflows, it does not age as long as the exposure remains.
That is why flaws disclosed years ago in widely used software components, legacy file-sharing protocols, and the management systems of routers or IoT devices such as cameras and printers continue to dominate malicious activity.
New vulnerabilities, meanwhile, are being exploited increasingly quickly. In previous periods, exploitation typically began about a week after a vulnerability was disclosed.
In 2025, FortiGuard Labs consistently observed that the time to exploitation had dropped to 24 to 48 hours, outpacing traditional patching cycles. Organizations are under pressure from both ends: the vulnerability disclosed this week and the one that has gone unpatched for five years on a device nobody checks. All with the same resources, budgets, and personnel.
Mitigated does not mean resolved.
A patch closes the door through which an attacker entered. It does not necessarily remove an attacker who has already gained access or invalidate what they have taken. The report warns that credentials, access paths, and information about infrastructure can persist long after the original compromise. They are cataloged, sold, and reused to bypass the discovery stage and go straight to execution.
In practice, an exposure—a vulnerability or misconfiguration—that has already been fixed can remain useful to an attacker: stolen passwords continue to work if nobody changes them, while a temporary fix applied during an emergency may disappear after a configuration change. Restoring systems from backups or installing new equipment using the same old template can also preserve exposure.
Accounts created by an intruder remain active until someone compares the configuration against a trusted version. Equipment that is no longer supported by its manufacturer will not receive future security updates. Legacy protocols that nobody has disabled, and which the report identifies as technical debt, can open predictable paths for lateral movement.
AI changes the economics of each of these scenarios. Testing thousands of old credentials against exposed services, reviewing configurations, or chaining known vulnerabilities used to require hours of work by a trained operator. Today, these tasks can be delegated to automated tools.
Latin America in the telemetry.
The report’s regional data point in the same direction. In 2025, FortiGuard sensors recorded nearly 15 billion exploitation attempts in Latin America, 39.85% more than the previous year. The report describes the region as having lower absolute volumes but faster growth, consistent with a higher rate of existing exposures being converted into exploitation.
Botnet figures show the results. Latin America recorded 2.09 billion detections of communications with command-and-control infrastructure, an increase of 12.05% and the second-highest figure worldwide, concentrated in Mexico, Panama, Venezuela, Brazil, and Colombia. Each of these detections corresponds to a device that has already been compromised and is now working for someone else.
Another figure is even more revealing. The region recorded the largest year-over-year decline in reconnaissance activity, but the report does not interpret this as reduced attacker interest. Instead, it points to the reuse of historical data on assets that remain repeatedly exposed.
Attackers already have the map. If the exposed service has not changed, the password has not been rotated, or the firmware has not been updated, that old map remains accurate. The ultimate cost becomes apparent in ransomware activity: 141 confirmed victims in Brazil, 69 in Mexico, 50 in Argentina, and 41 in Colombia during 2025, according to FortiRecon intelligence.
Hygiene that actually closes the door.
Just as washing our hands helps prevent infections, cyber hygiene can help keep computing environments healthy. None of the practices listed below is new. What is new is that, amid the growing threat posed by vulnerabilities, cyber hygiene has become more important than ever.
So, where should organizations start?
1) Always update.
This is especially important when moving to recent versions, which may incorporate fixes for vulnerabilities discovered through AI as part of manufacturers’ quality assurance cycles. Perhaps the oldest piece of advice, but also the most effective—and sometimes the least followed.
2) Prioritize patching based on exploitation, not just severity.
A vulnerability rated as medium severity that is already being actively exploited deserves more urgent attention than a critical one that nobody has managed to exploit. Public catalogs of known exploited vulnerabilities and exploitation probability scores help prioritize patching. The report also recommends measuring patching time as a security control and treating it as a business risk.
3) Close the entire incident, not just the vulnerability.
After fixing a critical vulnerability on an internet-facing device, organizations should close active sessions, rotate passwords and keys, compare the configuration against a trusted version, and look for accounts or access points that nobody recognizes.
4) Enable multifactor authentication for all remote and administrative access.
The report explains that brute-force attacks succeed because of credential reuse, the lack of limits on login attempts, and inconsistent MFA enforcement. All three issues can be addressed through configuration.
5) Keep management interfaces off the internet.
Management interfaces should only be accessible from trusted networks and devices.
6) Know which devices are no longer supported and which mitigations depend on temporary fixes.
The former identifies where future patches will not be available. The latter requires verifying after every change, restoration, or new equipment installation that the protection remains active. As part of the same review, legacy protocols that nobody uses should be disabled.
Testing your own defenses also pays off. For example, FortiGuard observed an inverse relationship between the frequency of penetration testing and the success of cloud identity compromises.
For governments and essential service operators across the region, cyber hygiene is also a budgetary decision. Including support lifecycle considerations in every purchase and funding equipment replacement before devices stop receiving updates costs less than responding to an incident involving a system for which no fix is possible.
AI does not make basic practices obsolete. It makes them more urgent because it brings the cost of identifying organizations that have failed to implement them down to almost nothing. This month, the question for any organization in the region goes beyond whether it has installed the latest patch. It also matters whether passwords, configurations, and equipment left behind after previous incidents are still there, waiting for someone to test them.
|
|
