Nine in 10 Australian organisations have experienced a confirmed security incident, suspected incident or near miss attributable to slow patching, according to research commissioned by enterprise Java provider Azul.
The findings are drawn from the company’s 2026 AI Vulnerability Gap Report and a survey of 200 Australian cybersecurity leaders, including CISOs. The research points to what it describes as a growing gap between how quickly attackers can weaponise newly disclosed vulnerabilities and how long organisations take to test and deploy security updates.
Among the Australian respondents, 90% reported at least one incident, suspected incident or near miss linked to slow patching, including 57% who said they had experienced a confirmed incident. More than half (51%) said they believe “AI-equipped attackers” can develop a working exploit within one to three days of a critical vulnerability being disclosed, while 7% believe it can happen in less than 24 hours.
On the defensive side, 45% said their organisation typically takes four to six days to deploy a critical security patch across production, and 15% said it can take up to a week. Pre-deployment testing was cited as a major factor in patching delays: 42% said testing adds four to six days to their Java patching cycle, while 30% said it adds one to three weeks.
The research also suggests many organisations do not set firm timeframes for non-critical issues. Only 33% of respondents said they mandate patching of non-critical vulnerabilities within a defined timeframe, while 32% said patching is handled on a best-effort basis and 14% reported having no formal patching policy.
Azul linked the report’s release to the OpenJDK quarterly update disclosed in October, which it said included a record 53 vulnerabilities — the highest number in a single update in more than a decade.
The company argued the results raise questions about whether traditional vulnerability management and patching processes can keep pace as AI reduces the time between vulnerability disclosure and exploitation, particularly for complex enterprise Java environments.
In the global version of the report, based on a separate survey of 300 U.S. security leaders conducted by Censuswide, Azul reported similar themes. It said 85% of surveyed organisations had experienced an incident or near miss attributable to slow patching, and 69% believed AI-equipped attackers could build an exploit within three days or less.
“Agentic AI has collapsed the margin defenders depend on, and most enterprises are still running patch processes built for a much slower adversary,” said Scott Sellers, co-founder and CEO of Azul.
You can read the full report here.
