Jonathan Zanger says AI hackers exploit bugs before patches arrive

Check Point chief technology officer Jonathan Zanger warned on Tuesday that artificial intelligence has compressed the window for cyberattacks to a matter of days, outpacing traditional software patching cycles. Speaking at Tel Aviv University's Cyber Week, Zanger stated that the median time between a vulnerability's public disclosure and its exploitation has dropped from three to four months to just a few days. This acceleration creates a critical gap where outdated software remains exposed to automated attacks before companies can deploy fixes.

Zanger identified aging software infrastructure as the primary target, noting that PHP-to-shell vulnerabilities affect approximately 70% of websites globally. He described this specific vulnerability type as severe because it allows unauthenticated remote control execution. "It allows unauthenticated remote control execution, which means that anyone can run it, and the potential damage is the largest possible because it's not just in the service, it's actually taking over the system," Zanger said.

The shift toward AI-driven attacks has altered the threat landscape over the past two years. In 2024, AI was primarily used to craft phishing emails. By 2025, AI systems adopted the Model Context Protocol, or MCP, which enabled them to operate autonomously across the internet. Zanger pointed to Amazon Web Services as a recent example where attackers exploited a vulnerability before an official security patch was released. Because manual response times cannot match automated systems, Zanger argued that companies can no longer rely on patching alone. "You can't really outpatch a machine, and you can't have humans operate at machine speed," he said.

The strategic response involves prioritizing prevention over detection and response. Zanger cited Vapor Panda, a Chinese state-sponsored threat actor, as an example of this new operational model. The group targeted more than 200 organizations across 14 countries using open-source infrastructure known as RTX. "Attackers are building more sophisticated infrastructure to conduct complex cybersecurity campaigns at scale, and AI is no longer an assistant, it's actually the operator behind at least some of those operations," Zanger stated.

Despite technical advancements, human behavior remains a persistent weak point in corporate networks. As organizations implement defense in depth strategies, attackers increasingly use social engineering to bypass technical layers. Zanger reported a 500% surge in the use of ClickFix, a technique where attackers impersonate IT administrators to trick employees into compromising their own systems. This human-centric approach is becoming more common in major corporate breaches.

Zanger referenced the Binance hack to illustrate how social engineering is replacing brute-force technical attacks. In that incident, attackers did not initially break into the system through code. Instead, they conducted fake job interviews to convince employees to download malware. Once inside, the attackers used AI to move laterally through the network, gaining access to additional systems.

The trajectory of these threats suggests a continued reliance on human interaction for initial access. Companies are now combining traditional cybersecurity defenses with intensive security awareness training. The goal is to prepare employees to recognize and resist the sophisticated social engineering tactics that currently complement automated AI operations.

Zanger emphasized that the current crisis stems from the combination of widespread outdated software and the speed of AI execution. The industry faces a challenge where manual processes cannot keep up with automated threats, requiring a fundamental restructuring of how security is managed.