That's the conclusion of a March 2026 Cloud Threat Horizons Report from Google's army of security investigators and engineers. Based on its observations from the second half of 2025, Google Cloud Security concluded, "The window between vulnerability disclosure and mass exploitation collapsed by an order of magnitude, from weeks to days."

The report concludes that the best way to fight AI-powered attacks is with AI-augmented defenses: "This activity, along with AI-assisted attempts to probe targets for information and continued threat actor emphasis on data-focused theft, indicates that organizations should be turning to more automatic defenses."

These days, Google's report notes, security threats are not targeting the core infrastructure of services like Google Cloud, Amazon Web Services, and Microsoft Azure. Those high-value targets are well secured. Instead, threat actors (a polite term that encompasses both criminal gangs and state-sponsored agents, notably from North Korea) are targeting unpatched vulnerabilities in third-party code.

The report contains multiple detailed examples of these attacks -- with victims not mentioned by name.