Hotel Summit 2026: The entire hotel business in one place
Speed is not just a matter of competitiveness. In cybersecurity, the difference between a few days and a few hours can mean the difference between a security vulnerability and a serious incident. Exactly the speed at which we discover these vulnerabilities is dramatically increasing. By mid-September this year, 66,401 software vulnerabilities were globally recorded. At the same time last year, there were 33,512. For comparison, during the whole of 2022, the year in which ChatGPT was introduced, around 25,000 were recorded. The data was recently analysed by Wired, the leading tech magazine in the world, warning that the consequences of AI development in cybersecurity are no longer hypothetical. The scale of the change is particularly visible among the largest tech companies. During September, Microsoft published patches for 974 CVEs, which is a new company record. In July, Oracle delivered 1,448 patches, compared to 309 in July 2025, while two major versions of Google Chrome published in June together contained 1,072 security fixes – more than the previous 23 major versions combined. Artificial intelligence is not only creating new security risks. It dramatically increases the capability of finding those that were already present.
The bottleneck is no longer necessarily finding the problem
Such a development sounds like good news at first. The earlier a vulnerability is discovered, the earlier it can be removed. However, Wired warns of a new asymmetry: the capability of automatically finding vulnerabilities grows faster than the capacity of the people who must analyse, prioritise and fix them. Exactly this challenge will be one of the key topics on the stage of the Automation Summit, a boutique regional conference on automation and artificial intelligence, which, with the support of leading brands – Robotiq, OTP banka, ASEE, HCL Software, Datum, DNA Consulting, Visa, Wonderful, Procesna inteligencija – will gather 500 experts on 15 and 16 October in Split. The pressure applies not only to large security teams, but also to organisations with limited IT resources and the people who maintain key open-source projects. Exactly there Francesca Curzi, Vice President – HCL Automation Orchestration, DevOps and Mainframe Sales Head at HCLSoftware AI & Automation, sees one of the key changes. "The figures clearly show the shift: the number of CVEs has almost doubled in a year, and generative AI lowers the barrier for both finding and exploiting vulnerabilities. For most organisations, the limitation is no longer detection – but the capacity to respond," warns Curzi. Security and IT teams, she adds, simply cannot manually analyse, prioritise and resolve issues at the speed at which they appear today. That is why automation, in her opinion, can no longer remain just an additional tool of security operations, but must become their fundamental infrastructure. Detection, prioritisation and patching need to be coordinated across increasingly complex hybrid environments, from the cloud to mainframe systems, in order to use human knowledge for decisions that genuinely require it, instead of repetitive triage. This is also the broader paradox of the current phase of artificial intelligence development. The same tools can help the defensive side find a problem that a human might overlook for months, but they also lower the technical and time barrier for those who want to exploit such a vulnerability.
AI is simultaneously part of the problem and part of the solution
Robert Preskar, Security & Compliance Line of Business Manager at ASEE, therefore considers the growth in the number of discovered vulnerabilities and patches a logical consequence of AI tools entering software development. "Generative AI is an extremely powerful tool that significantly accelerates both segments. Both finding vulnerabilities and resolving them," points out Preskar. Long-term, he expects today's rapid growth to stabilise because AI will simultaneously help increase the quality of the software itself, from the development cycle to penetration and classic testing. However, this does not mean that the transition period is without risk. Preskar particularly warns about systems and companies that will not adapt at the same speed. He sees the greatest threat in cyberattacks driven by artificial intelligence targeting people and their behaviour, as well as infrastructure and products that fall behind in the technological transition. For companies, investing in new security tools is therefore not enough on its own. Employee education and their ability to recognise increasingly convincing scam attempts and other attacks that exploit human weaknesses remain equally important. AI thus further emphasizes the problem that existed in cybersecurity even before it: technology can be automated much more easily than human judgment, responsibility and behaviour.
What when AI no longer just provides answers?
New security questions become even more complex with the transition from classic generative AI tools to agents that do not only answer queries, but can access business systems and independently execute tasks. Siniša Behin, co-founder of Datum, warns that this is precisely why it is necessary to change the way organisations think about AI security. "An AI agent is no longer just a chatbot – it accesses data, communicates with users and can initiate concrete business processes. That is why the security of AI agents is not a technical addition, but a business priority: it directly affects data protection, business continuity, compliance and customer trust," points out Behin. In practice, this means precisely defining what an individual agent is allowed to see, which decisions it can make and which actions it can independently perform. This is particularly important when AI systems run on a company's own infrastructure and gain access to sensitive business data. Behin states that at Datum, they therefore build security into the agent's architecture from the very beginning, through identity and authorization management, access control and continuous activity monitoring. "The greatest risk is not when AI makes a mistake in an answer, but when it acts autonomously outside its authority," he warns. The rule, he concludes, is relatively simple: the more autonomy an organisation gives to an agent, the more precisely it must define and supervise its boundaries.
Security becomes a board-level matter, not just an IT department issue
That is precisely the reason why we can less and less view cybersecurity as an isolated technical discipline. If an AI agent gains access to CRM, finance, internal databases or business processes and can act in them independently, decisions about its authority become technological, operational and business decisions at the same time. The same questions will be an important topic of the third edition of the Automation Summit. The conference programme is focused on concrete implementations of artificial intelligence and automation in various industries – from finance, healthcare and telecoms to logistics, retail and energy. The question is no longer whether AI can find a vulnerability that a human has not noticed. It is already doing that. Nor is it whether an autonomous system can be given enough authority to influence a real business process. That is already happening as well. The key question for companies becomes whether their security procedures, technology and people can keep up with the speed of the systems they are currently introducing into their business.
The Automation Summit takes place on 15 and 16 October in Split. Tickets are available via the Entrio.hr platform.
