“Are we exposed?” CIOs and CTOs heard that question all last week. On Tuesday, PHP shipped emergency fixes for two pre-authentication remote code execution flaws that date back to 2004. By Wednesday, Palo Alto Networks said every supported version of PAN-OS and Panorama was vulnerable and no fix was available. Cisco was reviewing 18 products and 13 cloud services, and Fortinet was reviewing eleven. NSA, NCSC and CERT-EU told operators to take unpatched systems offline, and Cloudflare’s CEO watched exploit attempts jump from thousands to millions within hours. People are calling it Black October.

An AI model found most of these bugs. The lesson for boards, though, isn’t about AI. Patching is no longer the bottleneck. Knowing where to patch is.

“Please go to your boards and ask for help right now. Not for AI, for the basics.” (Jason Clinton, Deputy CISO, Anthropic, Oct. 22.) Marc Benioff replied: “Jason is 100% right. Code red.”

Answering “are we affected?” should take minutes. That takes one real-time, authoritative record of every device, version, site, owner and exposure, plus automation that patches from that record and confirms the fix. Organizations without that record are still searching while attackers move. With vulnerability volume climbing this fast, the gap will only grow.

The number of vulnerabilities has more than doubled in the last year – and it is just getting started

From January 1 to October 13, 79,680 CVEs were published, 2.15 times the same period in 2025. Microsoft alone published 1,408 on October 13. That’s more than it disclosed in all of 2025, and its fourth record month in a row.

AI is behind the surge. Between April and July, Anthropic’s Project Glasswing partners verified more than 129,000 vulnerabilities, over 33,000 of them critical or high, and Anthropic estimates the real total is at least five times higher. Google’s threat intelligence group says monthly disclosures doubled from January to August, and that AI-found bugs are twice as likely to be remote code execution. OpenAI, whose model found the PHP flaws, expects such findings to “increase sharply in the coming months.”

Exploitation is speeding up just as fast. Mandiant’s mean time-to-exploit for 2025 was negative seven days, and Microsoft puts median discovery-to-weaponization under 24 hours. Amazon CISO CJ Moses saw PHP2Shell probing four days before a patch existed. His warning: the disclosure date isn’t the earliest date of exploitation. Reuters reported that one operator used AI agents to breach more than 100 companies for about $5,000 in tokens. That works out to roughly $50 a breach.

Attackers can’t be allowed to have a better asset inventory than you do

Enterprises simply aren’t keeping up:

• Verizon’s 2026 DBIR found just 26 percent of known-exploited vulnerabilities fully remediated, down from 38 percent, with a median of 43 days.
• Moody’s puts the median at 87 days for exploited bugs.
• Tenable found Citrix environments take a median of 461 days to patch.

The patch itself is rarely the obstacle. The obstacle is systems nobody knew about. As Armis’s threat intelligence lead put it this week, “the most common gap is not knowing an instance exists.” PHP is built into firewall consoles, NAS admin panels, printers, cameras and switches that never advertise it. Action1’s field CTO said it more bluntly: “The inventory is a guide, not a shield.” Most enterprises don’t even have the guide.

Two incidents this month show the stakes. On October 16, Palo Alto’s Unit 42 disclosed that attackers who compromised FortiManager instances got an inventory of more than 500 downstream FortiGate firewalls, including serial numbers and public IPs, and used it to gain root on those firewalls. In the Reuters case, when the target application had no flaw, the agents moved to adjacent infrastructure and found an exposed control panel nobody was watching.

AI now finds the bug, writes the exploit and maps your estate faster than your team can. The defender’s one lasting advantage is knowing the estate better than the attacker: every device, version, exposure and owner. That knowledge has to drive action in hours, not quarters.

Network and infrastructure is the front line

The hardest systems to see are the ones getting hit hardest. Google reports that edge and security appliances accounted for 14 percent of exploited vulnerabilities this year, and two-thirds of those were high or critical. Mandiant notes these devices usually lack standard EDR telemetry. In October, actively exploited flaws hit Ivanti Connect Secure, Cisco Secure Email Gateway, Palo Alto PAN-OS, Fortinet FortiMail and FortiOS, SonicWall SMA and Citrix NetScaler. Then PHP2Shell exposed the management plane of nearly every major network vendor at once.

You can’t put an agent on a router or scan what isn’t routable. That’s true across the campus, the branch and edge, the AI data center and the OT floor. The control that works there is an accurate, current record of what’s deployed, what it runs, where it sits, who owns it and whether it’s reachable from the internet, plus automation that acts on that record.

This is a board question now

Every board should ask its infrastructure leaders five questions this month:

1. Do we have a single, continuously updated inventory of every network device, server and appliance we operate — with software version, location, owner and internet exposure?
2. When the next PHP2Shell lands, how long does it take us to answer “which of our systems are affected”? Minutes, or weeks?
3. Is that inventory discovered from the live network, or is it a spreadsheet someone updates when they remember?
4. Can our automation patch directly from that inventory, or does every advisory start with a manual hunt?
5. After we patch, do we verify the fix took and the estate hasn’t drifted?

If the answers are no, weeks, spreadsheet, manual and no, the problem isn’t patching. It’s a gap in the fundamentals, and no patch-management budget will close it.

What to do this quarter, not next year

Treat this as a loop that runs continuously, not a project with an end date:

• Discover. Find everything on the network automatically, all the time. Unknown devices are the attacker’s favorite devices.
• Record. Put it in one system of record: the intended state of your infrastructure, not a scan export. Version, role, site, owner, exposure.
• Prioritize. Join that record against KEV and vendor advisories. Internet-reachable plus critical plus exploited goes first. The rest is a queue, not a panic.
• Patch from the record. Drive automation off the inventory so a new advisory becomes a targeted job, not a scavenger hunt.
• Verify and repeat. Confirm the live state matches the intended state, catch drift, and go again. Forever.

Automation helps teams keep pace, but without an authoritative inventory, it just misses things faster.

Attackers now discover at machine speed, while remediation still moves at the speed of someone opening a spreadsheet. Until that changes, attackers will know your infrastructure better than you do. Fix that first, and fix it this quarter.

Organizations today are not short of data, particularly in the domain of cyber. What many lack is a timely, trusted assessment that can help leaders act with greater confidence.

When a cyber incident begins, the technical questions surface first. What happened? Which systems are affected? Is the activity contained? But the questions that often shape the outcome are rarely technical alone. Who is behind the activity? What are they trying to achieve? Is this an isolated event or part of a broader campaign? Which customers, suppliers, assets or services are exposed? Is there a sanction, legal, regulatory or reputational dimension? And what is a proportionate immediate response while the facts are still incomplete?

This is why cyber is, in a meaningful sense, as much a human decision-making problem as a technological one. The OECD argues that digital security risk should be integrated into broader decision-making, rather than treated only as a technical issue. Tools can detect signals, spot patterns, correlate events and flag anomalies, but it takes people to decide what those signals mean, when to escalate, which trade-offs matter and what action the organization should take. In Moody’s recent whitepaper on supporting decision dominance through financial, corporate and trade intelligence, we make the case that the decisive moments in a cyber incident belong not only to systems, but to judgement.

That matters for CIOs and other technology decision-makers, because theirs is one of the most demanding decision environments in the enterprise. Reporting lines and structures vary by organization, but common themes tend to recur: technical complexity, compressed timelines, uncertain attribution and fragmented responsibility. Security teams may see indicators before they understand intent. Legal teams may need to assess obligations before the full scope of an incident is known. Communications teams often must prepare for scrutiny while operations are still working through containment. Business leaders may first need to decide when a decision must be made, then whether to pause a service, isolate a supplier, notify a regulator, issue a public statement or accept some temporary disruption to prevent greater harm.

The result can be a gap between signal and action, at a time when many organizations are experiencing a growing volume of cyber signals and alerts. Organizations commonly track mean time to detect and respond. But a less visible but equally consequential metric is decision latency: the time it takes to move from a technical signal to a shared understanding of what matters, and a decision about what to do. An organization can identify a threat quickly and still act too slowly if it cannot interpret the signal, convene the relevant stakeholders or agree on a proportionate response. The challenge is not simply speed — decisions made quickly but poorly can amplify harm. It is reducing decision latency without sacrificing judgement. This urgency is not theoretical and shouldn’t simply be admired. In her 2026 GCHQ Annual Lecture at Bletchley Park, Director Anne Keast-Butler described “a moment of consequence” shaped by the radical uncertainty. Her wider point is key for CIOs and their peers across the board: cyber security is a critical priority, and resilience depends on the ability to act with urgency, judgement and trusted partnerships.

From signal to context

Technical signals tend to become more useful when connected to wider context. A malicious domain, an unusual login, a compromised account or malware signature may tell a security team that something is happening. On its own, that signal rarely tells an executive what the organization should do next. Context reframes the question from “what does this indicator mean?” to “what decision should we make?”

That context can take several forms. Payment flows may provide additional context regarding the financial networks associated with an event or risk scenario. Ownership structures can help identify relationships between suppliers, counterparties or entities that may merit further review. Sanctions exposure may change the legal and compliance implications of a response. Adverse media may provide indicators of potential reputational or integrity concerns. Corporate linkages may reveal that what looks like a narrow technical event is in fact connected to a wider network of actors, assets or interests.

None of this removes uncertainty altogether, and no decision-maker should wait for perfect information before acting. What broader context does is improve the conditions under which judgement is exercised. Two incidents may look similar at the technical level but demand different leadership responses. One may be opportunistic criminal activity with limited broader consequence. Another may involve connections to a sanctioned entity, an organized crime network, a critical supplier or a state-linked ecosystem. The signal may look similar, but the appropriate response is not.

A cross-discipline exercise

This distinction matters because cyber response is often not contained within the security function, especially in a learning organization. A serious incident typically draws in teams from across multiple disciplines, such as security, IT, legal, risk, compliance, finance, procurement, communications and business operations. It may also involve external parties such as law enforcement, intelligence agencies, regulators, financial institutions, infrastructure operators and key suppliers. The CIO will not own every lever in this environment, and organizational structure will influence how close to the centre of the systems they sit, dependencies and information flows that affect the organization’s ability to respond effectively. Is the CIO supported or supporting during an incident? What leeway is afforded the CIO to act when required?

A common challenge in cyber response is not the absence of technical capability, but the absence, or fragility, of a shared decision model. Teams will have data, dashboards and incident playbooks in place, but still lack clarity on who decides, what information is needed, which trade-offs are acceptable and how quickly business context can be brought to bear. Ensuring a common operating picture — one that gives the leadership team a shared understanding of the same facts — tends to be a differentiator between organizations that respond coherently and those that do not.

For CIOs and CEOs, this is an organizational design problem as much as a technology one. Experience suggests that a cyber strategy that stands alone may be less effective than one integrated into the organization’s broader strategy from the outset. Cyber maturity should not be judged only by the number of controls deployed, alerts processed or systems monitored, but also by the quality of the decisions an organization can make under pressure. Using scenarios to test decision making can help refine organizational design, highlight blockers that may emerge at critical times, and improve leaders’ understanding of the potential consequences of poor decision making. That wider coordination challenge is reflected in CISA’s incident response guidance, which treats serious cyber incidents as events requiring coordination across multiple stakeholders.

Where integrated intelligence adds value

This is where integrated intelligence has a role to play. Its value lies less in the sheer volume of information it provides — most organizations already have more data than they can absorb — and more in its ability to help prioritize, separating signal from noise. It can help distinguish activity that is technically interesting from activity that may be strategically material. Used well, it can help identify enabling networks associated with an attack, inform disruption options and help focus scarce defensive resources on the assets, relationships and dependencies most likely to matter.

The aim is not to know everything. It is to develop sufficient understanding of the most relevant factors early enough to support timely actions while meaningful response options remain available.

CIOs can make this practical by asking five questions:

1. Which cyber decisions must be made in the first moments, the first hour, first day and first week of a serious incident?
2. Who is authorized to make them, what is their availability 24/7 and who deputizes in their absence?
3. Can technical indicators be linked quickly to business impact, financial exposure, legal risk, supplier dependency and external context?
4. Can security teams escalate without creating unnecessary alarm?
5. Can the CEO and board be briefed in decision-ready language, with recommendations rather than technical detail alone?

These questions move the conversation from reporting to leadership, and they reflect the human reality of cyber defence. Employees, analysts, managers and executives are asked to make repeated judgement calls under uncertainty, often with too much noise and too little time. Attackers are often well placed to exploit that reality; resilient organizations tend to design around it

Beyond visibility

Cybersecurity has spent years improving visibility, and that work remains essential. But visibility alone does not create resilience. The next challenge is decision quality.

For CIOs, the strategic shift is that cyber signals become most valuable when connected to real-world consequences: financial, operational, legal, reputational and geopolitical. In a fast-moving incident, the critical question is rarely whether the organization has more data. It is whether leaders can understand what matters, decide what to do and act while meaningful response options remain available.

The organizations that are often most effective in this environment are not necessarily those with the most dashboards. They are often those that have worked to reduce decision latency without sacrificing judgement, often through rehearsal, scenario testing and learning from gaps identified during those exercises. In an environment shaped by ambiguity, compressed timelines and interconnected risk, the ability to make better decisions faster may become one of the defining measures of not just cyber resilience, but of leadership itself.