Azul’s 2026 AI Vulnerability Gap Report has found that 85 percent of organisations running Java have already had a confirmed incident or a near miss tied to slow patching, as AI tools shrink the time attackers need to exploit newly disclosed vulnerabilities.
Key Takeaways
- 85% of organisations running Java have had a confirmed incident or near miss tied to slow patching, according to Azul’s 2026 AI Vulnerability Gap Report.
- 69% of 300 security leaders surveyed believe AI-equipped attackers can build a working exploit within three days, but only 56% of organisations can deploy a critical patch in that time.
- Only 19% of leaders say nearly all of their Java estate is on the latest security patch level.
A three-day gap between attackers and defenders
The report, based on a survey of 300 US security leaders conducted independently by Censuswide, found that 69 percent of respondents believe AI-equipped attackers can now build a working exploit within three days of a vulnerability being disclosed, including 22 percent who said less than 24 hours. Only 56 percent of organisations, however, say they can deploy a critical patch across production within that same three-day window, and just 13 percent can do so within 24 hours.
Pre-deployment testing is a major reason for the delay. Azul found that 58 percent of organisations add four or more days of testing to their patch cycle for Java runtime updates alone, longer than the three days most leaders believe an attacker needs. The report attributes this partly to the fact that a full OpenJDK quarterly update typically bundles hundreds of non-security code changes alongside security fixes; Azul’s own review of OpenJDK releases over the past six-plus years found that 23 percent of quarterly updates caused a serious regression.
Most Java estates have gaps
Only 19 percent of security leaders said that 90 percent or more of their production Java runtime estate is on the latest security patch level, meaning 81 percent of organisations have gaps in patch coverage. Visibility is a related problem: 51 percent of respondents said they have only partial or limited visibility into their Java runtimes, including embedded, legacy and unmanaged instances they suspect exist but cannot see.
Two-thirds of organisations have no mandated, time-bound commitment for patching non-critical vulnerabilities, with 38 percent patching on a “best effort” basis. Exploiting a known, unpatched vulnerability was the leading initial breach vector in Verizon’s 2026 Data Breach Investigations Report, accounting for 31 percent of breaches.
“Agentic AI has collapsed the margin defenders depend on, and most enterprises are still running patch processes built for a much slower adversary,” said Scott Sellers, co-founder and chief executive of Azul. “Our research shows security leaders understand the threat: awareness is no longer the gap; execution is.”
Where security leaders plan to focus next
Asked about their primary strategy for reducing exposure over the next 12 months, 32 percent of leaders named faster and more frequent patching and 26 percent named better visibility and inventory of software and runtimes, together accounting for 58 percent of responses. The biggest internal barriers to patching quickly, leaders said, are extensive pre-deployment testing, cited by 44 percent, and the complexity or age of affected systems, cited by 40 percent.
