Here is something that is possible today, not in a lab, not in a demo, but on a laptop with a subscription. Take a software update a vendor has just released for a device, say a router or a firewall. Hand an AI model the old version and the new one. Ask it to find what changed, work out which change fixed a security flaw, and write the attack code that takes advantage of that flaw on every device that hasn't been updated yet. Jason Clinton, the deputy chief information security officer at Anthropic, the company behind the Claude AI model, and the second most senior person responsible for its security, walked a room at AISA CyberCon 2026 through exactly that. Hours, not weeks.
Sit with that for a second, because it breaks something most of us have taken for granted for twenty years. The 90 days organisations have traditionally allowed themselves to install a security fix. The quarterly scan for weaknesses. The spreadsheet of known security flaws, sorted by severity, that someone reviews on a Friday. All of it rests on the assumption that it takes an attacker longer to turn a published fix into a working attack than it takes you to install the fix. That assumption is gone.
This is the business post I promised in last week's write-up. The personal one was about how we make decisions. This one is about what we at SelfCybr think the next 18 months look like for the businesses we work with, most of whom have no security team, nobody watching for attacks around the clock, and an IT provider on a monthly retainer. If that is you, the headline is this: vulnerability management, the routine of finding weaknesses in your software and patching them, is ending as you have been sold it. The thing replacing it is cheaper and simpler than you think, and the first thing to do is not buy a new tool. It is to agree on who you will call.
1. Why the next 18 months are going to be rough
Clinton's prediction was blunt: the next 18 months will be the roughest of our careers, with an incident on the scale of Log4j roughly every month. Log4j was a 2021 flaw in a small piece of software buried inside thousands of products, and it had IT teams around the world scrambling for weeks. He expected a noticeable jump in attacks within about 30 days of the talk, as criminal groups finish automating the part of a break-in that used to take a person days: moving from the first computer they get into across to the rest of the network.
The reason is a curve, not a product. The computing power used to train AI models has risen roughly four times a year since the first learning machine was built in 1957, and the cost of reaching a given level of capability is falling about ten times a year. Open AI models, the ones anyone can download and run with the safety controls removed, trail the most advanced models by six to nine months. So whatever the best model can do in a security lab today, a ransomware gang (the criminals who lock up your files and demand payment) can do on their own equipment by this time next year, for a fraction of the price.
What that looks like from the receiving end is already visible. The most advanced attacks across the economy are now run with AI: round the clock, in waves, with unusual techniques, and often you can't tell which AI is behind them. The cyber insurance underwriters at the small business workshop said the same thing in different words. An attack run by AI software that works through each step on its own squeezes the whole thing, from getting in to locking up your systems, into about an hour, and Australia does not have enough breach clean-up specialists to cope with a widespread AI-driven event.
One caution, which I made in the personal post too. The deputy security chief of an AI company has his own reasons to believe the curve. But the underwriters have the opposite incentive, they lose money when he is right, and they landed in the same place. When the optimist and the people who price the risk agree on the timeline, I take the timeline seriously.
2. Exhibit A arrived a week later: PHP2Shell
Clinton told the room to expect a Log4j-scale incident roughly every month, and a jump in attacks within about 30 days. About a week after CyberCon, the first one landed.
PHP is the programming language behind roughly 70% of the world's websites, including popular website platforms like WordPress, Drupal, Joomla and Magento, which between them run a large share of small business websites. On 21 October, PHP released emergency fixes for two critical flaws, now known as PHP2Shell, that let a stranger with no login take control of the server a website runs on. They affect every version of PHP released since 2012. The Australian Cyber Security Centre (ACSC), the Government's cyber agency, issued a Critical alert, its highest rating.
Three things about it line up almost exactly with what Clinton described.
AI found it. Researchers at two security firms, Wiz and Calif, found the same flaws independently, both using the most advanced AI models available, in code that had sat there for more than a decade. Wiz compared it to Heartbleed and Log4j, two of the biggest security flaws of the past decade, and said AI changes the cost of both finding a flaw and attacking it. That is the defender half of Clinton's argument working as advertised: flaws that people walked past for years are now being found.
There was no time to patch. Details leaked on social media the day before the planned release, and Amazon's decoy systems, set up to catch attackers in the act, logged an attack attempt on 17 October, four days before a fix existed. Cloudflare, which protects millions of websites, reported attack attempts climbing from tens of thousands within 45 minutes of the flaws going public to millions by the next morning. Installing fixes within two days, which is already ambitious for most small businesses, would still have left you exposed for six days.
It is hard to see. The flaws sit in PHP itself, so updating your website or its add-ons does nothing; the PHP software on the server has to be updated. And by several accounts, a successful attack leaves little more than a routine error message in the server's records, the kind nobody reads.
In the spirit of the devil's advocate from my last post: one incident is not a trend. The early attacks came from a leak, not from an AI working backwards from the fix. Working attack code was public within a day, and attempts quickly ran into the millions. But as of 23 October, no security firm had confirmed a single server successfully taken over. So I would call PHP2Shell evidence, not proof. But it is exactly the kind of event Clinton told the room to expect, it arrived inside his 30-day window, and it is the best argument I have seen for how he says to spend a security budget, which I cover below. Patching didn't fail here because people were slow. It failed because there was no fix to install until attackers had already started. What protected people was everything else: web hosts and firewall services (filters that sit in front of a website and block suspicious traffic) that blocked or patched on their customers' behalf, and the teams watching for an intruder instead of waiting for a fix.
3. Why vulnerability management as we know it ends
Here is the part that sounds like a contradiction. The same AI that lets an attacker turn a fix into an attack in hours lets a software maker find and fix the flaw before the product ships. Anthropic's Project Glasswing identified more than 100,000 flaws in six months, tens of thousands of them fixed, and has now been folded into an international programme giving defenders the same AI to find weaknesses and test their own defences by attacking them. Clinton's end state, which he called Vuln Zero, is that shipping software with a security flaw becomes negligence, because avoiding one is nearly free. Settings left wrong will still cause problems. Fake emails designed to trick staff (phishing) will get worse. But the coding mistake an attacker exploits becomes history.
If that is where the road ends, then the industry we have built around managing these flaws, the scanning tools, the dashboards, the ranked to-do list of 4,000 unfixed issues that never gets below 3,000, is managing a problem that is about to be solved at the source. His recommendation for how to spend a security budget in the meantime was the clearest thing I heard all week:
- 10% on vulnerability management. A decade of making it the top priority has not moved the needle. Get security updates onto laptops, desktops, phones and servers within two days of release, and stop there. Work through the older backlog later, if it still exists.
- 20% on designing for a break-in. Assume someone will get in, and make sure every login is checked so a stolen password can't be reused anywhere else. The industry calls this zero trust, though the term has since been stretched by marketing. Most of the products a small business already pays for can do this. It is often a setting in an admin screen nobody has opened.
- 70% on automated detection and response. That means software, and people behind it, that spot an intruder and shut them out. Attackers are running the latest AI with no safety controls and no approval process. The only place you can match that speed is in spotting them and throwing them out. The goal is minutes to hours, not days to months.
Notice what that split says. It does not say buy a better scanning tool. It says assume someone will get in, make a stolen password useless, and get very good at noticing when someone is inside. Which is, almost word for word, what we have been telling households since the day SelfCybr opened. It is just that nobody expected a leading AI company to say it to a room of security chiefs from large organisations.
4. What this means if you run a small business
You don't have a team watching your systems around the clock. You are not going to build one. The 10/20/70 split still applies; it just maps onto different things.
Install updates in days, not months. Two days is the one number to take from this post. Turn on automatic updates everywhere they exist: Windows, macOS, phones, web browsers, the internet router, the accounting software. If your IT provider holds updates back to install them once a month, ask them why, and ask what they would do if an attack arrived on day three. A monthly cycle was defensible when turning a fix into an attack took weeks. It isn't anymore.
If your website runs on WordPress or anything like it, PHP2Shell is the lesson: how quickly your website gets fixed is up to your web host, not you. Some of the big hosts switched off the vulnerable features before a fix existed and had it installed across every server within a day, without customers lifting a finger. Others left it to the customer. And nearly half of PHP websites run versions so old they no longer receive security fixes at all, so for them there is no fix coming. Ask your web host, in writing, what they did about PHP2Shell and how fast. If the answer is vague, that is your answer.
Make a stolen password useless. This is the 20%, and for a small business it is mostly already paid for. Turn on multi-factor authentication (MFA), the second step after your password, for email and the accounting system, and use an authenticator app or a physical security key rather than codes sent by text message, which criminals can intercept. Turn on the setting in Microsoft 365 or Google Workspace that only allows logins from your own staff on approved devices (Microsoft calls it Conditional Access); this is the setting Clinton was talking about. And before anyone changes the bank details you pay a supplier, phone that supplier on a number you already have on file, not the one in the email or invoice, and confirm the change is real. That last one is not optional: the underwriters at CyberCon said insurers now refuse to cover losses from scams that trick staff into paying the wrong account if you don't check payment changes by phone.
Know who you will call. This is your 70%. You can't watch for intruders and throw them out yourself, so the question becomes who does it for you and how fast they answer. The underwriters were candid that the incident hotline, the part of a cyber policy that sends experts to help you in a crisis, is where small businesses get the most value: a suspected breach is enough to trigger it, you don't pay an excess for the first few hours of help, and the people on the other end have done this before. If you have a policy, find that number tonight and put it somewhere that isn't on the laptop that just got locked up. If you don't have a policy, cover is relatively cheap and easy to get now, but insurers expect that to change within 18 months, with higher prices, stricter requirements and more exclusions. The same window Clinton gave.
Use a security standard built for your size. The Essential Eight, the Government's security checklist, was written for large organisations. ASD Essentials, which replaced it last week, still is, and we wrote about why small businesses should do nothing about it for now. SMB1001 is the one built for a business your size: it has levels, so you can start at Bronze and work up, and it maps almost exactly onto the three points above. Automatic updates, MFA, backups, a named person responsible for security, a plan for the day something goes wrong. It is also the standard insurers and larger clients are starting to ask about by name, which matters when cover gets harder to get and the insurance application form gets longer.
The honest position
I don't know whether Clinton's happy ending arrives on schedule. Vuln Zero might be 18 months away or five years, and the people with the best view of the data disagree about the destination even while they agree about the next stretch of road. What I am confident of is the shape of the stretch: attacks faster than any process that relies on people, security fixes that need installing within days, and a period where the businesses that come through fine are the ones that decided in advance what they would do when it happened.
That is why I don't think the answer for a small business is a new scanning tool, or a longer to-do list, or a dashboard with more red on it. It is three decisions, made once: updates go on automatically, a stolen password gets you nothing, and there is a number to call that someone will answer. Then a security standard that proves you made them, for the insurer, the client, and the day you need to show your work.
That is what our GRC as a Service does: we handle your governance, risk and compliance for you, get you certified against SMB1001 for one all-inclusive price with no lock-in, and we are the number you call. If you would rather do it yourself, the three decisions above are free and the standard is public. Either way, make them this month. The first Log4j-scale incident of Clinton's 18 months has already arrived, and on his timeline the next one is about a month away.
The personal write-up of CyberCon, on bias, devil's advocates and why nobody on the main stage could agree about AI, is here.
