VULNpocalypse
InformationalVulnerabilityMonitoring

McKinsey report: critical flaws exploited within hours of disclosure

A McKinsey report says critical flaws are now exploited within hours of disclosure; measure and shorten how long you take to fix them on critical systems.

Published
Updated
Exploitation
No specific vulnerability named; the report describes an industry-wide trend of faster exploitation

What happened

On 7 November 2026, an ANI wire story reported on a McKinsey report. According to the coverage, the report says frontier AI makes it easier for attackers to identify and exploit software weaknesses, and that companies will need to overhaul their cybersecurity strategies (Big News Network). Asia Bulletin published the same ANI text (Asia Bulletin). Both outlets carry one wire story, not separate reporting. The title and publication date of the McKinsey report are not confirmed.

Figures cited in the coverage:

  • The report says the average time between disclosure of a critical vulnerability and active exploitation is “now just a matter of hours, compared to a few weeks as recently as a year ago” (Big News Network).
  • McKinsey highlighted that by 2026, around two-thirds of exploited vulnerabilities were exploited on or before the day of disclosure (Big News Network).
  • In contrast, the median time organisations took to fully remediate vulnerabilities increased from 32 days to 43 days, and only 26 per cent of vulnerabilities were fully remediated. The coverage attributes these remediation figures to analysis based on Verizon’s 2026 Data Breach Investigations Report. The period covered by that change is not confirmed (Big News Network).
  • The report cites Anthropic’s Project Glasswing. According to the report, partners in that project identified more than 10,000 high- or critical-severity vulnerabilities using Claude Mythos Preview, and some reported bug-finding rates more than tenfold higher (Asia Bulletin). The sources do not independently verify these figures.

The sources name no specific CVE, product or exploited flaw.

Am I affected?

This is a trend report, not a disclosure about a specific product. It is relevant if you are responsible for patching or remediating software vulnerabilities, especially on critical systems. The sources do not identify any particular affected software or sector.

What to do now

These steps are the report’s own recommendations, as reported by Big News Network:

  1. Assign clear accountability for software vulnerabilities.
  2. Adopt continuous security monitoring and faster remediation, using automated discovery, prioritisation and containment combined with human oversight. The report says “Speed by itself is not enough to handle the job”.
  3. Strengthen identity and access controls, and apply stronger controls over AI-powered systems.
  4. Monitor third-party suppliers regularly and introduce secure development practices.
  5. Start with critical systems over an initial 90-day period, then expand based on measurable improvements.

Update, 9 November 2026

  • McKinsey says organisations need to strengthen four areas at once, namely cybersecurity practices, operating models, risk and control frameworks, and technology, rather than relying only on hiring more security staff or increasing patching. (ciso.economictimes.indiatimes.com)

Sources