Azul 2026 AI Vulnerability Gap Report: 85% of Organisations Running Java Have Had an Incident, Suspected Incident or Near Miss Due to Slow Patching

Detailed summary

69% of 300 security leaders believe AI-equipped attackers can build an exploit in three days or less; 44% need four days or more to patch

GUEST RESEARCH: 69% of 300 security leaders believe AI-equipped attackers can build an exploit in three days or less; 44% need four days or more to patch

Azul, the trusted leader in enterprise Java for today’s AI-first world, today released The 2026 AI Vulnerability Gap Report, a survey of 300 U.S. security leaders at organizations where Java is a significant share of the production application estate, conducted independently by Censuswide. The report finds that 85% of organisations have already experienced an incident or near miss attributable to slow patching, including 55% who report a confirmed incident and 53% who report a near miss, as AI shrinks the time attackers need to exploit newly disclosed vulnerabilities.

The findings arrive weeks after October’s OpenJDK quarterly update disclosed a record 53 OpenJDK vulnerabilities, the most in a single update in well over a decade, at a time when exploitation is outpacing patching. Virtually every leader surveyed said AI-powered attack tools have increased their organisation’s security exposure over the past 12 months, yet 59% have not changed their security posture: 34% describe a moderate increase and are reassessing, while 25% say the increase is slight and not a priority. Meanwhile, 69% believe AI-equipped attackers can build a working exploit within three days or less, including 47% who say one to three days and 22% who say less than 24 hours.

Only 13% of security leaders say their organisation can deploy a patch for a critical vulnerability across production in under 24 hours, while 43% need one to three days, 32% need four to six days and 12% need longer. In other words, the report finds a three-day gap: 69% of leaders believe an attacker can build a working exploit within three days, but only 56% of their organisations can get a critical fix out in that time. The same gap shows up at the 24-hour mark: 22% believe attackers are already working inside that window, but only 13% say they can deploy that fast.

Testing…

Opening of the article, excerpted from iTWire. To read the rest, open the article on the publisher's site.