Palo Alto Networks CEO says AI finds flaws faster than firms can patch

What happened

YourStory reports on a LinkedIn post by Nikesh Arora, Chairman and CEO of Palo Alto Networks. In the post, Arora says frontier AI models can find software vulnerabilities and link them into potential attack paths, and that organisations struggle to verify, prioritise and fix flaws at the same pace. YourStory quotes him: “Most organizations do not have capacity to patch at the speed needed, especially the smaller ones.” This is an opinion and industry-trend piece. It does not disclose a new vulnerability, CVE or incident.

Arora also says that different models identify different weaknesses, so one model cannot provide complete coverage, YourStory reports.

YourStory also gives the context below. These points have not been independently checked here against the original statements:

• NIST says submissions to the National Vulnerability Database rose 263% between 2020 and 2025. YourStory reports that NIST enriched nearly 42,000 records in 2025 and calls this still insufficient. In April 2026, NIST adopted risk-based prioritisation focused on exploited flaws and critical software.
• Anthropic says partners in its Project Glasswing programme had identified more than 10,000 high- or critical-severity flaws by June. The programme launched in April 2026 and Palo Alto Networks is one of its partners.
• OpenAI reported on November 4 that a controlled Linux-kernel pipeline generated candidate patches for 948 local privilege-escalation vulnerabilities. Human researchers reviewed the findings before reporting them to maintainers.
• CERT-In issued a November 4 advisory warning of an AI-assisted threat actor targeting non-bank lenders, fintech firms, payment providers and cryptocurrency platforms.

Specific CVEs, affected products and versions are not confirmed in the source.

Am I affected?

The source names no specific product or version, so this report does not show direct exposure for any system. According to YourStory, Arora says smaller organisations in particular lack the capacity to patch at the speed needed. YourStory adds that smaller businesses often lack security specialists, and that larger ones must test fixes against existing applications.

Arora also points to operational technology. YourStory explains that patching these systems can be difficult because downtime may affect safety or essential services.

What to do now

1. Review your full remediation workflow, not only discovery. YourStory lists the steps after a flaw is found: confirm it, assess the risk, develop a fix, test for disruption and deploy it. It also notes that false positives waste time and untested patches can disrupt services.
2. Prioritise flaws that are being exploited and flaws in critical software. YourStory reports that NIST moved to this approach in April 2026.
3. Where a permanent fix needs testing time, consider virtual patching through endpoint, WAF, cloud or network controls, as Arora suggests. According to YourStory, a virtual patch is a rule that blocks a known exploit method without changing the affected software.
4. Treat virtual patches as temporary. YourStory reports that they do not remove the weakness. It also reports OWASP’s caution that they protect only the traffic the system inspects and the attack variations their rules recognise. Track each virtual patch until the real fix is deployed.
5. If you work in Indian fintech, payments, lending or crypto, read CERT-In’s November 4 advisory directly. Its details beyond YourStory’s summary are not confirmed here.

Sources

• YourStory: AI’s ability to find cyber flaws outpacing firms’ capacity to fix them: Palo Alto Networks’ Nikesh Arora