“Vulnerability exploitation: 44 days; corporate patching: 87 days” ... Moody’s warns of AI-driven credit risks [fn Market Watch]

[Financial News] As advances in artificial intelligence (AI) technology make cyberattacks more sophisticated, companies’ ability to respond to security threats is emerging as a new factor shaping their creditworthiness. In particular, an analysis finds that if companies’ security responses fail to keep pace with advances in attack technology, cyber risks could translate into financial burdens.
In a report released on the 23rd titled “The Negative Impact of Weak Cyber Defenses on Creditworthiness Will Intensify as AI Advances,” global credit rating agency Moody’s said that the spread of autonomous AI agents could heighten cyber risks for companies and financial institutions. 
According to data from cyber threat intelligence firm Flashpoint, cited by Moody’s, the average time from the disclosure of a software vulnerability to its exploitation in an actual attack fell from 745 days in 2020 to 44 days in 2025. In just five years, the time it took attackers to exploit vulnerabilities dropped sharply.
By contrast, companies’ response times were relatively slow. An analysis of about 9,500 issuers Moody’s rated early this year found that the median time to remediate known exploited vulnerabilities (KEVs)—vulnerabilities confirmed to have been used in actual attacks—was 87 days.
Moody’s researcher Yoni Katz also identified companies’ management of security vulnerabilities as a factor that increases credit risk. He noted, “Among the approximately 9,500 issuers assessed, 60% had at least one vulnerability that had been confirmed as exploited in an actual attack but remained unpatched as of 2025.” 
Katz also noted that “as autonomous AI agents become more widespread, existing cyber defenses alone may no longer be enough to respond to attacks.” In the past, large-scale cyberattacks were carried out by attackers with ample funding and technical expertise, such as state-sponsored hacking groups. But advances in AI mean that attackers with relatively fewer resources can also develop the capacity to launch sustained attacks.
AI agents, unlike people, can operate continuously and explore numerous attack paths simultaneously. If automation increases across the process, from detecting vulnerabilities to carrying out attacks, companies may have even less time to find and fix security flaws.
 Moody’s expects companies with weak cyber resilience to face the greatest credit risks in this environment. It noted that risks could be relatively higher for companies with poor security patch management or a growing backlog of unresolved vulnerabilities, as well as those operating large digital networks.
By industry, it assessed that cyber risks had risen in sectors with many small and midsize issuers, including public institutions, nonprofits, educational institutions and utilities. Banking, insurance and information technology (IT) are also major targets, but their comparatively greater capacity to invest in security could partially mitigate the risks, it said.
 It added, “In an environment where cyberattacks are becoming automated and the range of targets is expanding, companies’ speed in responding to security threats and their ability to build resilience will be key factors in assessing future credit risks.” 


[email protected] Kim Hyun-jung Reporter