AI’s ability to find cyber flaws outpacing firms’ capacity to fix them: Palo Alto Networks' Nikesh Arora

Nikesh Arora, Chairman and Chief Executive Officer of Palo Alto Networks, has raised concerns about the growing use of frontier artificial intelligence (AI) models to identify software vulnerabilities and link them into potential attack paths. 

While these capabilities can help strengthen cybersecurity, they could also give attackers faster ways to exploit weaknesses in enterprise systems. The bigger challenge, Arora notes in a LinkedIn post, is ensuring that organisations can verify, prioritise and fix vulnerabilities at the same pace at which AI can discover them.

“Most organizations do not have capacity to patch at the speed needed, especially the smaller ones,” Arora wrote. Smaller businesses often lack security specialists, while larger ones must test fixes against existing applications. He also says models identify different weaknesses, so one model cannot provide complete coverage.

Finding a flaw is only the start. Teams must confirm it, assess the risk, develop a fix, test for disruption and deploy it. False positives, or incorrect alerts, waste time, while untested patches can disrupt services.

The scale is growing. The US National Institute of Standards and Technology said submissions to its National Vulnerability Database rose 263% between 2020 and 2025. It enriched nearly 42,000 records in 2025, but this was still insufficient. In April 2026, it adopted risk-based prioritisation, focusing on exploited flaws and critical software.

AI developers are linking discovery with repair. Anthropic’s Project Glasswing, launched in April 2026 with Palo Alto Networks among its partners, gives selected organisations access to Claude Mythos Preview for defensive security. Anthropic said partners had identified more than 10,000 high- or critical-severity flaws by June and expanded the programme to around 150 additional organisations. 

On November 4, OpenAI reported that a controlled Linux-kernel pipeline generated candidate patches for 948 local privilege-escalation vulnerabilities, which allow a user to gain higher access rights. Human researchers reviewed the findings before reporting them to maintainers.

In India, CERT-In’s November 4 advisory warned of an AI-assisted threat actor targeting non-bank lenders, fintech firms, payment providers and cryptocurrency platforms through machine intelligence and payment APIs. The agency has also issued 2026 guidance on AI-assisted vulnerability defence and AI security auditing.

Arora advocates virtual patching as an interim measure. “The most obvious solution is virtual patching. This is a time tested technology that is currently available with cyber vendors for endpoints, WAF, cloud, network use cases.” 

WAF is a web application firewall, which filters website and application traffic. A virtual patch is a security rule that blocks a known method of exploiting a flaw without changing the affected software. It buys time while a permanent update is tested, but does not remove the weakness. The Open Worldwide Application Security Project cautions that it protects only the traffic the system inspects and attacks variations its rules recognise.

Arora calls for a shared vulnerability clearing house and faster development of protective signatures, or detection rules. He also highlights operational technology, systems that monitor or control physical processes such as energy, water and transport. Patching them can be difficult because downtime may affect safety or essential services.