Azul has released the 2026 AI Vulnerability Gap Report, a survey of 300 U.S. security leaders at organizations where Java makes up a significant share of production applications. The Azul 2026 AI Vulnerability Gap Report finds that 85% of organizations have already experienced a confirmed incident, suspected incident, or near miss attributable to slow patching, as AI-powered attack tools increasingly compress the time between vulnerability disclosure and exploitation.
The survey, conducted independently by Censuswide, found that 55% of respondents reported a confirmed security incident and 53% reported a near miss linked to slow patching, with respondents able to select both. The findings arrive shortly after October’s OpenJDK quarterly update disclosed a record 53 vulnerabilities in a single update, the most in well over a decade.
Azul’s 2026 AI Vulnerability Gap Report Highlights A Critical Patching Shortfall
The core finding of the report is a three-day gap between attacker speed and defender readiness. 69% of security leaders believe AI-equipped attackers can build a working exploit within three days or less, including 47% who say one to three days and 22% who say less than 24 hours. Yet only 13% of organizations can deploy a critical patch across production in under 24 hours, and just 56% can do so within three days.
Mandiant’s M-Trends 2026 report estimates the mean time to exploit dropped to negative seven days in 2025, meaning exploitation is frequently occurring before a patch is even released. Exploiting a known, unpatched vulnerability was also the number one initial breach vector in Verizon’s 2026 Data Breach Investigations Report, accounting for 31% of breaches.
Pre-deployment testing is a primary contributor to slow patching. 36% of leaders said testing adds four to six days to their Java runtime patch cycle, 33% said one to three days, and 22% said a week or more. Only 9% reported testing taking less than 24 hours, and no respondent skips testing entirely. In total, 58% of organizations add four or more days of testing alone.
The testing burden stems from the nature of full OpenJDK quarterly updates, which can include hundreds of non-security code changes alongside security fixes. Azul’s assessment of OpenJDK releases over the past six-plus years found that 23% of quarterly updates (6 of 26) caused a serious regression, leaving enterprises caught between security urgency and production stability.
Java Estate Visibility And Patching Policy Gaps
Only 19% of security leaders said that 90% or more of their production Java runtime estate is on the latest available security patch level. That means 81% of organizations have gaps in patch coverage, including 21% where half or less of their estate is current.
Visibility is a compounding problem. While 49% of leaders claim full visibility into every Java runtime instance including embedded, legacy, and unmanaged instances, 51% concede they have only partial or limited visibility. Azul notes that even the 49% figure is likely optimistic, as missing instances are invisible to the same tools meant to detect them.
Two-thirds of organizations (66%) have no mandated, time-bound commitment for patching non-critical vulnerabilities. 38% patch on a best-effort basis, 33% operate under a defined SLA, 25% take a risk-based approach, and 3% have no formal policy at all. The report highlights that AI agents are increasingly capable of chaining vulnerabilities across systems, citing a July 2026 OpenAI evaluation where autonomous agents chained vulnerabilities to escape a test sandbox and gain unauthorized access to Hugging Face systems.
The biggest internal barriers to faster patching, as identified by security leaders, are extensive pre-deployment testing (44%), complexity or age of affected systems (40%), and limited visibility into known vulnerabilities (36%). Delays from vendors were the least cited barrier at 25%, and the only factor outside the enterprise’s control.
Looking ahead, 32% of leaders plan to prioritize faster and more frequent patching over the next 12 months, while 26% are focusing on better visibility and software inventory. Together, these two strategies account for 58% of leaders’ primary plans for reducing exposure. Azul co-founder and CEO Scott Sellers said that awareness of the threat is no longer the gap, but that execution remains the core challenge for most enterprises.
Azul’s Security-only, Stability-first updates are designed to include only security patches with no additional code changes bundled in, covering Java 8, 11, 17, 21, and 25 as well as older versions like Java 6 and 7. The company also offers a JVM Vulnerability Risk Assessment and Intelligence Cloud JVM Inventory feature for continuous discovery of exposed runtimes across enterprise environments.
Pokdepinion: 85% hit by slow patching and two-thirds still have no patching deadline. Not a good time for IT admins out there.
