Overview
Artificial Intelligence (AI) has been a great enabler for productivity – helping us complete tasks faster, conduct detailed research, produce reports, write code and more. In the web world, we’re seeing increased usage to build websites, rapidly iterate through designs and ideas and even to perform Search Engine Optimisation (SEO) analysis with impressive results.
These areas of AI are going to keep improving and keep doing so at a rapid rate. WordPress has been late to this party with WordPress 7 finally having formal AI integration. While there’s an overwhelmingly positive side to AI, there’s also one area which can easily be forgotten: security.
How the world used to be
For the last two decades, the security vulnerability lifecycle has generally followed a very predictable pattern:
Security researchers would manually fuzz and probe systems to find vulnerabilities and then disclose these to the vendor. In many instances, this was (and still is) managed through platforms such as HackerOne where security researchers then receive a reward for this discovery. This is to discourage the release of the vulnerability onto the black market and to ensure the vendor therefore gets a fair chance to work on a patch.
Vendors would then work with the security researcher to understand the problem, update their code and test to ensure the bug/vulnerability is now fixed. This process was typically 30–90 days, with Google (as part of Project Zero) setting a 90+30 disclosure deadline policy. In years gone by, Microsoft has complained that 90 days wasn’t enough for their engineers to be able to release a patch.
While it wasn’t always perfect, we had predictable release cycles and disclosure timelines. Patching was still critical of course, but it could be planned and could easily be managed with existing schedules.
What’s changed?
Quite simply, AI. What was once predictable is now in the realms of chaos and unpredictability. While there’s a lot of hope around what AI can and can’t do, what we’re rapidly finding out is that there’s plenty it can and is doing when it comes to security.
At the start of 2026, AI models were discovering security vulnerabilities and bugs, but they weren’t always accurate. This meant that they placed a lot of burden on developers to review and continually reject the “findings” some of these models produced. This is commonly referred to as AI slop, meaning it was able to produce something which looked real and accurate but hadn’t been validated or was completely wrong.
Fast forward to the latest, frontier models and it’s already a different story. What was very hit and miss is now accurate and meaningful. Just recently, Mozilla had the Firefox codebase reviewed by a preview of Claude Mythos. While they’d already been using other models (including Claude Opus) to review code, this new model was able to find an additional 271 (!!) vulnerabilities in the source code. This image clearly depicts the rate of change:
Of course, this cuts both ways. While it’s great that organisations can use AI to preemptively discover bugs and patch them, it can equally be used in adversarial ways to find vulnerabilities or even exploit known vulnerabilities.
I believe we’re only at the start of this wave too. AI models are very rapidly improving and we’re seeing advancements on a weekly basis. This rapid pace means any assumptions made based on older models may be rapidly outdated and we need to be aware of this.
How does this affect existing patching and security methodologies?
Time. Where we had predictable cycles, we now have potential chaos.
This isn’t to say we need to panic at all, just that we must assess any security disclosure or patch the moment it’s made public. Any delay could mean your website has already been compromised if it’s a serious vulnerability.
In practical terms, this may mean things such as outage windows where updates are applied at 2am are no longer applicable. Businesses who have critical systems where this change could cause downtime will either need to accept this downtime or spend the time to engineer greater resilience in their platform.
The cost of ignoring this could be very high.
This change is so significant that the Five Eyes cybersecurity agencies have issued a joint statement. It’s well worth a read, but essentially they’re clearly expressing the urgency that this new frontier creates for the world. This includes practical action:
- Reduce your attack surface
- Accelerate your patching processes
- Address legacy systems
- Review and strengthen identity and access controls
- Prepare for incidents before they happen
One key message from their statement also stands out:
Success will not come from having the most tools. It will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy.
Just as IT was once treated as a fringe part of business strategy, cyber security needs to be front and centre of any business continuity planning. Steps like Multi-Factor Authentication (MFA) need to be mandatory, not a consideration.
How is Conetix reacting to the threat?
At Conetix, we have a formal risk assessment model and risk treatment plan. We use a Risk Matrix to help determine overall risk, using likelihood and impact as the two dimensions:
Previously, some risks had a relatively low likelihood of occurrence, so even where the potential impact was high or extreme, the overall risk remained lower. With the changes in AI, this likelihood changes for many scenarios and therefore the overall risk changes.
This means that our treatment of the risk must also change. We’re continually enhancing all of our security procedures and security tooling to detect and combat these new threats and increased risks. This includes internal tooling that we’ve developed to both help identify the threats as well as mitigate them.
For example, our monitoring of WordPress related threats ensured that 99% of our WordPress hosted websites were protected against wp2shell before attacks were observed in the wild. This included our Managed Hosting for WordPress, where the patch was applied within hours of release (on a Saturday morning).
What should small business owners do?
Unfortunately, your risk has also increased significantly. Prior to AI, the cost of a hacker or malicious actor specifically targeting your business (eg, spear phishing or whaling) to extort money offered little to no reward. It was easier for them to go after larger companies, who they know would have money and they would ask for a larger amount.
Now, it could cost less than A$0.20 in AI usage to specifically target your business. Phishing emails no longer need to be generic but could have explicit wording and signatures from existing suppliers, customers and staff. Fake invoices that once stood out can now be based on information they can easily find on the web or extract from email if they gain access to your systems.
Your website also remains a very high risk attack surface. With the collapsed timelines between the discovery of a vulnerability and it being exploited, sometimes it could be as short as hours before your website is compromised.
To combat this, you need to be taking multiple steps within your business to improve your security posture. This shouldn’t be a one-off exercise, but something you build in and plan to keep improving.
Passwords. Our decade-old advice for things like passwords still remains true: ensure they’re unique and sufficiently complex.
Permissions. Review any developers who may have had access in the past and remove their accounts if no longer needed. These developers commonly use the same username across multiple sites and this is detectable by scrapers. If they’ve then also used the same password across multiple sites then the chances of your site being hacked will be almost certain.
Updates. These need to be a daily occurrence or you need to ensure you’re paying someone to do them. Are you also reviewing the emails from your plugin providers and hosting company regarding new threats? As outlined above, even daily may not be rapid enough with the rapidly changing environment. Be prepared to run patching at any time of the day or night when it’s critical.
Hosting. Good website security starts with good hosting. Look at what plans your hosting company has and if there’s any additional security you can enable. Make sure you’re taking advantage of a Web Application Firewall (WAF) and ideally, a live patching system such as WP Guardian.
Backups. For many scenarios, the likelihood of something going wrong has increased from unlikely to possible. While you should always have backups of your site, what’s critical now is that you test them. Make sure you can restore your website. Make sure nothing is missing from the backups, as the chances are you may require them. Use the 3-2-1 rule to ensure you have multiple backups in multiple locations.
What comes next?
If you’re a technologist, AI offers some exciting opportunities and will still continue to rapidly evolve and improve over the next few years. We’re not even close to seeing the rate of development decrease yet and in fact it’s still accelerating.
Similarly, the security threat presented by AI still has not yet reached its peak. We’re seeing a significant number of vulnerabilities discovered this year and the rate of these should hopefully slow, but model advancements mean it’s possible for new bugs to be discovered and used in ways humans would take months or years to figure out. AI can and has turned this timeline into mere hours already for WordPress this year.
As the saying goes:
Security has to get it right all the time and hackers only have to get it right once.
The companies most likely to survive this new threat will not necessarily be those with the largest security budgets or teams. They will be those that adapt fastest to the ever-changing threat landscape.
If you take the threat seriously by ensuring you’ve adjusted your procedures and you have a fallback (eg, backup), you’ve significantly reduced the AI derived risks your business faces and should be able to continue to operate without disruption.
