When AI finds the flaw *before* the attacker does

Fortinet has released security updates for FortiOS and several other products, patching vulnerabilities that were discovered with the help of AI models and then validated by human researchers ^[1]. The company is keeping the technical details under wraps until November 2026, but its CISO, Phil Quade, made one point clear: attackers have the same tools ^[1].

It's like a race where both sides suddenly got faster bikes. The defender who spots a weakness first can patch it before anyone gets hurt. The attacker who spots it first has a head start.

AI as a vulnerability spotter

Fortinet's approach combined machine learning models with human review ^[1]. The AI flagged potential weaknesses, and security researchers then confirmed which ones were real and exploitable. That two-step process matters, because an AI model on its own can throw up plenty of false positives.

The company has not said which models it used, or how the process worked in detail. What it has said is that the vulnerabilities were serious enough to warrant immediate patches and a long disclosure delay ^[1].

Why the delay until 2026

Fortinet is holding back the technical details until November 2026 to give organisations time to apply the patches before the information becomes public ^[1]. The logic is straightforward: if you publish exactly how a flaw works before most people have patched it, you hand the attackers a blueprint.

The flip side is that some security researchers argue for faster disclosure, on the grounds that secrecy can let vendors sit on problems. Fortinet's position here is that the patch is out, and the detail can wait.

The attacker has AI too

Phil Quade's remark that threat actors also have access to AI tools is worth paying attention to ^[1]. It means the old assumption, that a skilled attacker needs weeks or months to reverse-engineer a system and find a weakness, no longer holds. An AI model can scan code, test inputs and spot patterns far faster than a person working alone.

That doesn't mean every script kiddie now has nation-state capabilities. It means the gap between finding a flaw and exploiting it has narrowed, and the window for patching has got smaller.

What the Cyber Resilience Act says

The EU's Cyber Resilience Act, which has applied since 11 September 2026, sets out what manufacturers of products with digital elements must do when a vulnerability or an incident happens ^[2].

For an actively exploited vulnerability, the manufacturer must send an early warning through ENISA's reporting platform within 24 hours of becoming aware of it ^[2]. That warning goes to the national authority and to ENISA, and it should include enough information for others to decide whether they are at risk.

Within 72 hours, a more detailed incident notification is due, and within a month, a final report ^[2]. The fines for failing to report, or for putting an insecure product on the market, can reach 15 million euros or 2.5 per cent of global annual turnover, whichever is higher ^[2].

The act also requires manufacturers to provide security updates for the expected lifetime of the product, and to handle vulnerabilities that are reported to them ^[3]. If a router or a firewall is sold with a promise of five years of support, those five years now come with a legal duty to patch.

When the clock starts

The 24-hour deadline for an early warning counts from when the manufacturer became aware of the actively exploited vulnerability, not from when it was convenient to report it ^[2]. It works like losing a bank card: the clock starts when you notice it's gone, not when you get around to calling the bank.

That means the internal process for deciding whether something counts as actively exploited, and for escalating it, needs to be quicker than the spreadsheet review that used to happen every quarter.

What this means for you

If you make, sell or operate products with digital elements, here are three questions to ask now:

1. When a vulnerability is flagged, who decides whether it is actively exploited, and how quickly can that decision be made?
2. Do you have a process for getting an early warning out within 24 hours, including at weekends?
3. Can you show, if asked, when you first became aware of a vulnerability and when each report was sent?

The third question is the evidence question. A supervisor or an auditor asking why a report went out after 30 hours instead of 24 will want to see when the flag was raised internally. That record needs to be one you can stand behind.

Sealing the timeline as it happens

Here, the thing to seal is the first detection note, the decision to escalate, and each report as it is sent. Sealing takes a fingerprint, not the data, so the content of a vulnerability report never leaves your systems.

If a question comes up later about when the clock started, anyone you share the record with can check that it is exactly what was recorded at the time, unchanged since. It doesn't show that the report was complete or that the response was adequate, but it does show when each step happened.

You seal at each step: when the vulnerability is first noted, when the decision to report is made, and when the early warning and the later reports go out. Internal audit, supervisors and incident responders are the ones who will check.

The content stays with you. Your system sends a fingerprint of the record, not the record itself, to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. To check, anyone you share the record with calculates the fingerprint again and compares it with the sealed one. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. Detection is noted and sealed: "Potential RCE flagged in FortiOS by internal scan, 2026-10-15 14.22 UTC."
2. Escalation is decided and sealed: "Escalated to security team for validation, 2026-10-15 16.03 UTC."
3. Early warning is sent and sealed: "Early warning submitted via ENISA platform, 2026-10-16 09.47 UTC."

If someone later asks why the warning went out after 19 hours instead of sooner, the sealed records show what happened when, without anyone having to trust whoever kept the log.

What to watch

The Cyber Resilience Act's requirements for security updates and vulnerability handling apply to products placed on the market from 11 December 2027 ^[3]. Fortinet's patches, released in October 2026, fall under the existing regime, but any manufacturer selling networked products from late 2027 onwards will need to have the reporting process ready and tested.

The question of how AI changes vulnerability discovery is not going away. If defenders and attackers both have the tools, the side that can patch faster, report accurately and show what it did will have the edge.