{"id":4317,"date":"2026-08-26T07:11:40","date_gmt":"2026-08-26T07:11:40","guid":{"rendered":"https:\/\/ribesalat.com\/?p=4317"},"modified":"2026-08-26T07:11:42","modified_gmt":"2026-08-26T07:11:42","slug":"business-cybersecurity-vulnerabilities","status":"publish","type":"post","link":"https:\/\/ribesalat.com\/en\/business-cybersecurity-vulnerabilities\/","title":{"rendered":"A Business Digital Risk Snapshot: Rising Vulnerabilities and Autonomous AI-Powered Attacks"},"content":{"rendered":"

Cybersecurity vulnerabilities in businesses are no longer a secondary technical indicator. They have become the most reliable barometer of corporate digital risk. The first half of 2026<\/strong> confirms a trend that no organisation can continue to treat as the sole responsibility of IT: vulnerabilities are increasing in volume, severity and, above all, speed of exploitation. This is compounded by a new phenomenon: autonomous attacks<\/strong> powered by artificial intelligence, capable of identifying and exploiting a security gap without direct human intervention. This analysis of business cybersecurity vulnerabilities<\/strong> in 2026 is based on real exploitation data, not projections.<\/p>\n

Technical Overview 2025-2026: Greater Volume, Higher Severity and Increasing Pressure<\/strong><\/h2>\n

The evolution of cybersecurity vulnerabilities in businesses between 2025 and 2026<\/strong> provides a more accurate view of cyber risk than a simple comparison of headline figures. Vulnerabilities are not only becoming more numerous; their technical profile also requires stronger prioritisation and governance capabilities.<\/p>\n

According to Tokio Marine HCC<\/strong>\u2019s monthly monitoring, analysed by Rib\u00e9Salat, some months in 2025 recorded higher volumes but a lower average CVSS score due to the proportion of low-severity or informational vulnerabilities. In June 2026, however, the increase was accompanied by elevated severity: 7,964 vulnerabilities<\/strong> and an average CVSS score of 7.1<\/strong>, driven by a higher number of high-severity flaws in the 7-10 range.<\/p>\n

The 7.1 score is very close to the 7.2 recorded in November 2025, but with a substantially higher volume. Compared with the 2025 range of 3,036 to 5,519 vulnerabilities per month, the June 2026 figure represents an increase of approximately 44.3%<\/strong> compared with December 2025 and more than double, or 115.2%<\/strong>, the February 2025 figure.<\/p>\n

\n\n\n\n\n\n\n\n\n\n
Period<\/strong><\/th>\nVulnerabilities\/month<\/strong><\/th>\nAverage CVSS<\/strong><\/th>\nAssessment<\/strong><\/th>\n<\/tr>\n<\/thead>\n
February 2025<\/td>\n\u22483,700<\/td>\nModerate<\/td>\nLower end of the 2025 volume range<\/td>\n<\/tr>\n
September 2025<\/td>\n\u22484,340<\/td>\nModerate<\/td>\nHigher volume, contained severity<\/td>\n<\/tr>\n
November 2025<\/td>\n\u22485,100<\/td>\n7.2<\/td>\nTemporarily high severity<\/td>\n<\/tr>\n
December 2025<\/td>\n\u22485,519<\/td>\nModerate<\/td>\nUpper end of the 2025 range<\/td>\n<\/tr>\n
June 2026<\/td>\n7,964<\/td>\n7.1<\/td>\nPeak volume and sustained high severity<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Source: monthly vulnerability monitoring; Rib\u00e9Salat internal analysis based on Tokio Marine HCC data.<\/em><\/p>\n

The key is not to count vulnerabilities, but to translate that volume into risk decisions by prioritising actual criticality, internet exposure and potential business impact. At this point, vulnerability management ceases to be a purely technical task and becomes the barometer of maturity in the fight against business cybersecurity vulnerabilities<\/strong>.<\/p>\n

\"\"<\/figure>\n

Explore the full classification in our guide to types of cyber risk and how to mitigate them<\/a>.<\/em><\/p>\n

From Vulnerability to Attack: Why Exploiting a Security Gap Is Now a Matter of Minutes<\/strong><\/h2>\n

One of the most difficult messages to convey to business leaders about cybersecurity vulnerabilities is that many no longer require a sophisticated attack or weeks of preparation. Critical flaws have been observed in remote support tools, VPNs, browsers, file transfer servers and web applications<\/strong>. When these systems are internet-facing or unpatched, attackers can move from identification to exploitation very quickly by creating a privileged session, executing code or moving laterally to other connected assets.<\/p>\n

The Trivy case<\/strong> clearly illustrates this acceleration. In March 2026, a threat actor identified as TeamPCP<\/strong> compromised Aqua Security\u2019s open-source Trivy scanner and its associated GitHub Actions, rewriting 76 of 77 release tags<\/strong> with credential-stealing malware. The incident, designated CVE-2026-33634 and rated critical with a CVSS score of 9.4<\/strong>, turned a trusted security tool into an attack vector for thousands of development pipelines. According to Beazley Security, the operation accelerated when an autonomous AI agent scanned thousands of public repositories, identified weaknesses in access controls and exploited them without direct human intervention<\/strong>.<\/p>\n

The assumption that smaller organisations are not targets is no longer valid. Many attacks begin through automated scanning for vulnerable versions, exposed management panels or reused credentials. Attackers then decide whether to monetise access through ransomware, data theft or fraud. Not every vulnerability results in an incident, but some drastically shorten the distance between being exposed<\/strong> and being compromised<\/strong>.<\/p>\n

\n

\u201cAt Rib\u00e9Salat, we see that many companies have advanced very quickly in their digital transformation, but have not always reviewed their actual exposure, security controls or the suitability of their cyber programme with the same level of depth and on a sufficiently regular and up-to-date basis,\u201d<\/em> explains Montserrat Recio<\/strong>, Senior Cybersecurity Specialist at Rib\u00e9Salat.<\/p>\n<\/blockquote>\n

The AI Multiplier Effect: From Traditional Automation to Autonomous Attacks<\/strong><\/h2>\n

The difference between traditional cybercrime automation and autonomous AI-powered attacks is not speed, it is autonomy<\/strong>. Conventional automation follows fixed rules and requires an operator to make each decision. AI agents, by contrast, set objectives, create their own workflows, learn and change strategy in real time, at near-zero marginal cost.<\/p>\n

According to Beazley Security\u2019s first-quarter 2026 report, exploited vulnerabilities increased by 43%<\/strong> quarter on quarter, with more than 15,200 newly disclosed vulnerabilities<\/strong>, almost 3,900 of which were high-risk, and a 43% increase in additions to CISA\u2019s Known Exploited Vulnerabilities (KEV<\/strong>) Catalogue. The multiplier effect can be illustrated simply: whereas an attacker might previously have launched 10 campaigns and compromised 100 victims, an operator with ten AI agents can now launch 100 campaigns against 10,000 targets<\/strong>.<\/p>\n

This phenomenon partly explains the increase in cybersecurity vulnerabilities during the first half of the year. NIST acknowledges that the National Vulnerability Database can no longer enrich every record at the rate at which vulnerabilities are being discovered. Tools such as Google\u2019s Big Sleep<\/strong> agent, which identified a vulnerability in SQLite before it was exploited, and coordinated disclosure programmes such as Anthropic\u2019s<\/strong> are accelerating the discovery of flaws in open-source code. Organisations have more CVEs to manage, while the window for patching them before exploitation by a human or autonomous agent has narrowed to hours<\/strong>.<\/p>\n

Critical Vulnerabilities in the First Half of the Year: What Businesses Should Monitor<\/strong><\/h2>\n

The most significant business cybersecurity vulnerabilities<\/strong> identified during the first half of the year share a common pattern: they affect widely deployed technologies, including cloud environments, VPNs, firewalls, browsers, collaboration tools and enterprise management systems, and can often be exploited remotely without prior credentials. This intensifies digital supply chain risk, or third-party cyber risk. Businesses must protect not only the systems they directly control, but also understand what is happening across their technology ecosystem, including cloud providers, SaaS platforms, integrations and remote access tools.<\/p>\n

A critical vulnerability affecting a single vendor can impact thousands of organisations<\/strong> simultaneously. A flaw in a booking platform or cloud provider can lead to operational disruption, fraud, regulatory penalties or reputational harm, even where the affected business has made no direct error. As highlighted by Rib\u00e9Salat risk consulting<\/a>, managing vulnerabilities means managing business risk: applying patches is not enough. Organisations must know which assets are critical and understand the impact that an interruption could have.<\/p>\n

Sector Impact: IT\/OT Convergence and the Hospitality Industry<\/strong><\/h2>\n

Although cybersecurity vulnerabilities affect every sector, their impact is not the same for all organisations. The convergence of information technology (IT) and operational technology (OT) is particularly concerning in industry: a vulnerability may lead not only to a data breach, but also to the shutdown of a production line. Manufacturing, automotive, engineering, logistics and energy companies should prioritise reviews of exposed assets and business continuity arrangements for incidents such as ransomware.<\/p>\n

The hospitality industry<\/strong> is another environment with significant cyber exposure. It handles large volumes of personal and financial data and depends on booking, payment, guest Wi-Fi and property management systems, including PMS, CRS and point-of-sale systems<\/strong>, that operate continuously. The most common cyber losses in the sector include:<\/p>\n