AI vulnerability discovery scores the highest impact of 20 emerging risks

Risk managers, auditors and senior executives at 316 companies spent April and May ranking 20 threats they have not yet felt. AI discovery of cyber vulnerabilities came back first, according to Gartner. Three months earlier the same quarterly survey put information integrity risk at the top and left AI vulnerability discovery out of the top five.

The exploit step stopped being hard

Two things changed underneath that number. AI systems scan for previously unknown flaws at a volume no patching team can absorb, and the step from finding a flaw to holding working attack code has shrunk to close to nothing. Writing the exploit used to be the part that kept most attackers out. It no longer is. A defender inherits a backlog of unpatched critical vulnerabilities growing faster than it can be cleared, inside systems that AI integration has made harder to see into.

AI models improved at generating working exploits, and vendors have launched defensive partnerships to identify and patch exploitable code first. Anthropic’s Project Glasswing and OpenAI’s Daybreak are two of them.

Respondents gave the risk a time frame score of 1.92, on a scale where 1 means tangible impact in less than a year and 2 means one to two years, so the average answer lands just under two years. Seventy-six percent placed it in their top ten, and it ranked first in all four regions: 78% in Europe and in the Asia-Pacific, 75% in the Americas, 70% in the Middle East and Africa. Banking, financial services and insurance respondents picked it at 78%, everyone else at 74%.

“The ability of AI to increase the efficiency and accessibility of vulnerability discovery is making it increasingly difficult for traditional risk management approaches to keep pace,” said Kevin Mercado, Senior Principal Analyst, Research, in the Gartner Risk & Audit Practice. “Without corresponding improvements in governance, security operations, and remediation capabilities, AI-driven vulnerability discovery may outpace organizational defenses, increasing the likelihood of significant cyber incidents and operational disruption.”

They rate themselves ready for it

The same respondents ranked the risk first for preparedness. First on impact, third on proximity, first on preparedness: the threat they call the most damaging is the one they say they have handled best. Preparedness here is self-reported on a five-point scale, where the top mark means the risk is actively discussed and steps are in place. Nothing in the survey tests those steps against the capability that pushed the risk to the top of the list.

Four checks follow from that. Recalibrate the impact assigned to cyber risk, since faster discovery pulls third-party, business continuity and legal exposure with it. Revisit risk appetite for continuous exposure, and settle how long a vulnerability may sit unpatched. Require stronger security validation from vendors, on the question of whether they are already compromised. Move vulnerability management toward faster, more automated remediation.

AI vulnerability discovery is absent from the five risks respondents saw the most business upside in, which went to AI-driven competitive displacement, agentic AI, AI-driven skill erosion, AI intellectual property control and U.S. financial deregulation. It sits at the top of the list with nothing on the other side of it.

Download: The high-performance team playbook