With Maria Singh
The Vulnerability Didn't Change. The Attacker Did.
Most organisations defer some patches and record the decision as an accepted risk. Those decisions assumed that turning a patch into a working exploit took skill and weeks. Anthropic's 2026 evaluations show a model doing it in under an hour for about $2,000 per exploit, and its September threat report describes criminals running exploit research around the clock. Here is how to rewrite the risk register.









