From weeks to hours, how AI has reset the cybersecurity clock

Madrid. The reaction window in cybersecurity has gone from weeks to hours. PHP2Shell proved it, the critical PHP flaw that allowed access to a server without a password. Luis Bravo, our Head of Information Security, analysed it in an opinion piece in Crónica Económica, also picked up by Radio Líder.

A ten-year-old flaw, cracked in weeks

PHP2Shell had existed for years. Exploiting it was so complex that it sat at the limit of what a human researcher can tackle. AI has removed that barrier.

That’s great news for defence, but the same capability is within any attacker’s reach. In fact, attack attempts were detected before the patch was even published. Cybercriminals are increasingly turning to these tools to cut costs and speed up their attacks.

Three measures to protect your company in the AI era

• Immediate response protocols. The time between a vulnerability being discovered and someone trying to exploit it is minimal. Your company needs to be able to patch and update in hours, not weeks.

• Review AI-generated code with the same rigour as any other, or more. The fact that AI writes code that works on the first try means it often gets reviewed less than it should. According to Veracode, around 45 % of AI-generated code contains vulnerabilities.

• Watch your AI agents like any other employee. They no longer just answer questions. They query internal systems, move data and execute processes, and with too many permissions and no oversight they can be manipulated to work for the attacker.

Speed cannot run ahead of security

The key comes down to three habits that don’t depend on any tool. Give each agent only the access it needs. Log and audit everything it does. Keep human oversight on sensitive decisions.

It’s the same rule we apply to our own product. ADA brings together all of a company’s knowledge, what lives in its systems and what only its people know, into a brain that AI uses to work. By relying on what the company truly knows, AI stops hallucinating, costs less, and every answer can be traced back to its source and audited.

The era when a flaw could sleep in the code for ten years is over. If you want to know whether your company would find out through the patch or through the attack, let’s talk.