There are plenty of things that come with running a technology business, but if I am honest, one of the things that keeps me awake at night at the moment is cyber risk. Not because cyber security is new, and not because AI has suddenly made attackers unstoppable. It is because the pace has changed. The volume has changed. And the margin for delay feels much smaller than it used to.
So far this year, I have personally seen the number of patches, security updates and dependency upgrades increase dramatically across the systems we look after. That includes core development languages such as Java, widely used frameworks such as Spring Boot, and the everyday applications every organisation depends on. Browsers such as Chrome and Edge are no longer occasional update items; they are frequently being updated multiple times a week, and sometimes more than once in a day. That is not background noise. It is a signal.
Why this matters now
The concern is not theoretical. We are seeing more attempted attacks against clients, more urgent patch cycles, and more pressure on teams to respond quickly. At the same time, there have been very public attacks on major companies and public bodies. The UK Government’s Cyber Security Breaches Survey 2025/2026 reported that 43% of UK businesses and 28% of charities identified a cyber breach or attack in the previous 12 months. That figure has held steady since last year, but it masks a stark divide by size: medium (65%) and large (69%) businesses are far more exposed than micro (42%) and small (46%) firms. For anyone responsible for live systems, customer data or operational resilience, that should be sobering.
That’s not a government statistic — it’s my own read of where we’re heading: I think it’s likely that 100% of our clients will be attacked in some way in the next 12 months. The only question is, how many will be compromised?
What worries me most is the narrowing gap between disclosure and exploitation. A vulnerability can move from advisory to active risk very quickly. Chrome has moved to a two-week release cadence for stable versions, with each release regularly carrying its own batch of security fixes. Microsoft Edge has now followed suit, moving to the same two-week major-release cycle. In the Spring ecosystem, reporting has highlighted a sharp increase in disclosed vulnerabilities during 2026 — well over 200 for the year — including critical and high-severity issues across Spring Boot, Spring Security and related projects. This creates a relentless operational challenge: the work is not simply to patch, but to understand what matters, test safely, deploy quickly and prove that the exposure window has been reduced.
Every home hacker becoming world class
With openly available models, often without controls or guardrails, now available, every home hacker has similar tools to those only available to state actors a few months ago.
For defenders, that changes the planning horizon. Capabilities that were previously available only through monitored, hosted systems have become available to a far wider group of actors. And the situation is likely to get a lot worse over the coming six months.
But even without that future scenario, the present-day reality is demanding enough: software is changing faster, vulnerabilities are surfacing faster, and attackers are moving faster.
The good news: the basics still matter
The right response is not to chase every new AI headline. It is to execute the security fundamentals properly and with urgency. AI-powered attackers still rely heavily on familiar weaknesses: unpatched systems, weak authentication, excessive permissions, exposed services, poor monitoring and insecure code. But the cost of leaving those weaknesses in place is rising.
Organisations should be asking straightforward questions. Are critical vulnerabilities patched quickly enough? Is multi-factor authentication enforced, and is it phishing-resistant where the risk justifies it? Are permissions reviewed regularly? Can the security team detect rapid reconnaissance, credential harvesting or unusual data movement? Is AI-generated code reviewed, tested and scanned before it is trusted?
How StableLogic is thinking about it
From my perspective, the practical question is not whether AI will change cyber security. It already is. The question is whether organisations can keep their basic controls moving at the same speed as the threat. That means disciplined vulnerability management, clear ownership, fast decision-making, and an honest understanding of which systems are most exposed and most important.
Many organisations used to work on an n-2 patch model, staying within two releases of the current version. The theory was that this gives time for the supplier to resolve any security issues or functionality problems in the latest release. With major security risks being exposed each day, this is no longer a safe approach.
It is also a reality that all organisations are going to have to run hard just to keep up. It’s also likely that the recent trend of an increasing amount of the IT budget going to security is going to accelerate.
A few practical steps for organisations
- Reduce the exposure window by patching high-risk vulnerabilities really quickly (at StableLogic we now have resource focused completely on this).
- Strengthen authentication, especially for administrator, developer and remote-access accounts.
- Review permissions and remove unnecessary access.
- Improve monitoring for fast-moving, automated attack patterns.
- Test incident response plans against AI-assisted phishing, credential theft and data extortion scenarios.
- Set clear internal rules for the use of AI tools, particularly where client data or source code is involved.
- Treat AI-generated code as untrusted until it has been reviewed, tested and scanned.
The takeaway
AI is not replacing cybersecurity fundamentals. It is making the cost of getting those fundamentals wrong much higher. What keeps me awake at night is not a single dramatic scenario; it is the daily accumulation of vulnerabilities, patches, urgent updates, attempted attacks and operational decisions that all need to be handled well.
What’s the one basic control you’d bet your business hasn’t got right?
