Agentic AI Drives 36% Surge in Disclosed Vulnerabilities, Beazley Finds

What happened

Why it matters

• ·A 36% single-quarter spike in disclosed vulnerabilities means existing patch SLAs and triage workflows are almost certainly under-resourced: programs designed around historical disclosure rates will accumulate unpatched exposure faster than teams can remediate, raising regulatory risk under frameworks that treat unpatched known vulnerabilities as negligence.
• ·The compression of the gap between disclosure and active exploitation is the critical operational threat here. If agentic tools are accelerating both discovery and weaponization in parallel, the patch prioritization logic that sorts critical from high from medium severity may no longer reflect actual exploitation timelines, requiring a recalibration of risk scoring models.
• ·Organizations deploying agentic AI in their own security research programs face a dual-use governance challenge: the same capabilities that accelerate internal vulnerability discovery can be turned outward or misused, creating a need for clear policy boundaries, output controls, and audit logging around AI-assisted security tooling that most governance programs have not yet defined.

Governance controls affected

What to do now

• ☐Audit your current patch SLA thresholds against Q2 2026 disclosure velocity data and determine whether critical and high-severity remediation windows need to be shortened to reflect the new baseline.
• ☐Review your vulnerability risk-scoring model to assess whether exploitation-timeline assumptions built on pre-agentic disclosure rates still hold, and adjust prioritization criteria accordingly.
• ☐Inventory any agentic AI tools used by your security team in vulnerability research and confirm that output logging, scope controls, and use-policy boundaries are documented and enforced.
• ☐Stress-test your incident severity classification process against a scenario in which a disclosed vulnerability moves to active exploitation within days rather than weeks, and update escalation thresholds if needed.
• ☐Brief your board or risk committee on the Beazley findings as evidence that AI-accelerated threat conditions are now a quantified, insurer-documented risk that may affect coverage terms and cyber risk appetite statements.

What to watch next

Compliance teams should monitor whether Beazley and peer cyber insurers begin adjusting policy terms, coverage conditions, or underwriting questionnaires to reflect AI-accelerated vulnerability exposure, as this would translate directly into enterprise cybersecurity compliance obligations. The EU Cyber Resilience Act and related frameworks impose patch and vulnerability disclosure obligations that will be harder to satisfy as disclosure volumes grow, and enforcement bodies may reference quantified industry data like Beazley's when assessing organizational preparedness. Watch also for follow-on data from CISA and sector-specific regulators on whether exploitation timelines are formally shortening, which would trigger mandatory SLA revisions across regulated industries.