McKinsey: cybersecurity in the age of frontier AI, a race against time

By McKinsey & Company · October 11, 2026.

McKinsey is using National Cybersecurity Awareness Month to warn of a growing challenge: in the era of frontier AI, time is the enemy of enterprise cybersecurity teams. The traditional paradigm assumed organizations would have time to detect and fix their vulnerabilities, but according to the email that premise is now obsolete.

The key figure is that active exploitation of critical vulnerabilities can now happen within hours. Until recently, as of last year, the window was roughly three weeks. The figure is attributed to Benjamin Klein, Charlie Lewis, Rich Isenberg, Venky Anant and other co-authors. The email adds that advances in quantum computing will put further pressure on these teams.

The technology, however, cuts both ways. AI can also help detect and respond to threats faster. It can take on routine cybersecurity work and free analysts up for higher-value investigations and decisions. In a recent blog post, Lewis and his co-authors explain how public agencies can harness these capabilities while keeping humans in charge of high-consequence actions.

The email links to seven pieces of reading:

- «The speed problem: How frontier AI exposes weakness in enterprise cybersecurity». It argues that attackers move at machine speed while organizations decide at committee speed. To close the gap, it proposes a different operating model and committed executive leadership. - «How agentic AI can transform public sector cybersecurity». It contends that agentic AI could transform the efficiency and effectiveness of public agencies' cybersecurity programs. - «The board's role in managing emerging AI risks». It captures a discussion among cybersecurity executives and board members on the challenges and opportunities of AI. - «Quantum is almost here: Are you and your systems ready?». It describes the quantum threat as the biggest cyber risk in history. It proposes an approach to protect data and intellectual property, future-proof digital infrastructure and mitigate risk. - «Securing the agentic enterprise: Opportunities for cybersecurity providers». It states that the rise of agentic AI exposes companies to new cybersecurity risks. That creates opportunities for providers that manage to make autonomous systems more secure. - «Tech resilience for healthcare providers: Inaction has a heavy toll». It notes that cyberattacks and tech outages at healthcare providers have reached record highs and that robust prevention, detection and recovery plans are needed. - An interview with Kara Sprague, CEO of HackerOne, on how AI is reshaping cybersecurity. She argues that security teams must shift from finding vulnerabilities to reducing exposure.

The email also announces a McKinsey Live event on October 15. Michael Chui and Roger Roberts will discuss the «Technology Trends Outlook 2026» report. They will explore where momentum is building, how major trends are converging and what they mean for executives, workers and society.

The email is an editorial selection with brief descriptions and does not go into figures or methodology beyond what is stated. For details, the original reports would need to be read.