AI attacks are forcing companies to rethink the patch-and-move-on model

Palo Alto Networks chief executive Nikesh Arora is urging organisations to combine rapid software fixes with virtual patching and a more integrated security operation as AI accelerates both attacks and vulnerability discovery.

AI security is moving into a new phase in which threat detection, patching and response are increasingly shaped by artificial intelligence itself. Nikesh Arora, chief executive of Palo Alto Networks, has argued that the problem is no longer limited to finding software weaknesses, but to managing the pace at which those weaknesses are exposed and fixed as models and attack techniques advance. As AI systems improve, more flaws are likely to surface, making the old assumption that a single large patch cycle can secure a system less credible, according to the comments reported by DigitalToday and recent coverage by Fortune.

Arora said a direct patch is often not enough on its own because deploying too many fixes at once can create uncertainty about how enterprise systems will behave afterwards. He has instead pointed to a hybrid approach that combines a conventional software fix with a virtual patch at the network edge, so that exploit attempts can be blocked while code changes are tested and rolled out. ITPro has separately reported that this model is designed to buy time against attackers who are increasingly able to use fresh patches as a guide to remaining weaknesses.

The emphasis on layered defence is also reflected in Palo Alto Networks’ broader direction. In recent reporting, Axios described a new subscription service that uses several AI models, alongside human expertise, to look for vulnerabilities and recommend remediation before adversaries can act. ITPro has also reported on Palo Alto Networks’ work with IBM’s Project Lightwell, which aims to pair AI-assisted vulnerability intelligence with network-level virtual patching so that organisations can interrupt attacks even before formal fixes are in place.

Arora has warned that the longer-term answer will not be to throw more isolated tools at the problem, but to rebuild the security operations centre around faster coordination. He has argued that logs, threat intelligence and security products need to sit within a modern security orchestration, automation and response platform, allowing defenders to move quickly and consistently across detection and recovery. In his view, perimeter systems also need to be modernised and brought together on a single platform, rather than managed as disconnected layers.

He has also cautioned that companies are still moving too slowly to match the pace of AI-enabled attacks. In the DigitalToday report, Arora said many chief information officers and chief information security officers are already carrying heavy workloads and have not previously dealt with threats on this scale, which makes rapid decision-making harder. He suggested that the result is a familiar cycle in which organisations repeatedly take systems offline to patch one issue after another, rather than addressing the underlying security structure.

That warning extends to the way businesses deploy AI inside their own operations. Arora has said the technology should not be left only to frontier model developers, because the infrastructure was built by the technology sector and defended by the security industry on behalf of boards and organisations. He has also urged companies to scrutinise the security of coding harnesses and other execution environments used by AI development tools, warning that if an agent can bypass guardrails, it may also be able to conceal malicious code within software.

The broader concern is that AI is creating a wider attack surface even as firms race to adopt it. Palo Alto Networks has presented AI as both a defensive tool and a source of new risk, while industry coverage has increasingly highlighted how identity weaknesses, patch management gaps and weak operational discipline continue to drive breaches. The implication of Arora’s comments is that organisations cannot rely on a single technical fix: they need faster patch deployment, stronger perimeter controls, more integrated operations and tighter governance over how AI tools are introduced into production systems.