The Patching Grace Period Is Over: Four Cybersecurity Predictions For 2027

Alex Spokoiny, Chief Security and Trust Officer, Check Point Software.

gettyFor years, we have talked about how AI will change cybersecurity. I think 2027 is when that conversation becomes practical.

AI is moving from helping people work faster to acting on its own. Attackers use it to find and exploit weaknesses. Defenders use it to find those weaknesses first and respond at machine speed. At the same time, companies are building AI agents that access data, use tools, write code and run business processes.

That changes how fast security must move, what we protect, how we manage it and how we architect it.

I’ve seen both sides. As a CIO, I helped drive AI transformation and build the infrastructure behind it. Now, as chief security and trust officer at Check Point Software, I focus on defending against AI-powered threats and helping organizations securely build the agentic enterprise. My conversations with security leaders worldwide confirm it: These shifts are no longer theoretical.

AI-powered attacks are moving toward autonomy. Agents map environments, find weaknesses, build attack paths, adapt when blocked and carry out much of an attack without human involvement. Sophisticated attacks once required sophisticated people, but AI changes that.

The early signs are clear. In its first month, Anthropic’s Project Glasswing helped partners discover over 10,000 high- and critical-severity vulnerabilities, with some reporting discovery rates more than 10 times higher. Likewise, Google’s Cloud Threat Horizons research found that the time between vulnerability disclosure and widespread exploitation has shrunk from weeks to days.

More vulnerabilities. More fixes. Less time to deploy them. The patching grace period is over. Organizations will need continuous upgrades, and systems that can’t be upgraded must be segmented and protected with other controls.

Defense becomes proactive. AI agents will continuously explore environments for exploitable weaknesses and attack paths before attackers do. Continuous threat exposure management (CTEM), agentic scanning, virtual patching and automated remediation become essential, with agentic patching close behind.

The security operations center (SOC) will evolve into an agentic SOC, where AI agents detect, investigate, contain and respond to threats at machine speed.

If attackers use AI agents to find a way in, your agents need to get there first.

AI transformation is moving beyond copilots. Companies are building agents that access corporate data, use tools, work with other agents and run entire business processes on their own.

This is a huge opportunity. Blocking it is not the answer. Making it safe is.

The risks are already visible. Check Point Research’s “AI Security Report 2026” found that high-risk AI prompts doubled from 2% to 4% in a year, while organizations used an average of 10 AI applications monthly, many without official approval.

Now, imagine those applications acting on their own.

Securing this shift takes layers: visibility into AI use, including shadow AI; control over sensitive data; security throughout AI application development; and protection for the agents themselves.

As agents gain autonomy, identity and access become critical. What can an agent reach? Which tools can it use? Which actions need human approval?

Permissions alone are not enough. We also need to see what agents actually do. Does their behavior match the original task they were given? Do they stay within their boundaries? Can someone manipulate them through prompt injection or malicious data into crossing those boundaries?

By the end of 2027, an unmanaged AI agent with broad permissions may be treated much like an unmanaged administrator account is today.

Security environments are hard to manage. Take firewall policies. After years of changes, thousands of rules pile up. Some are obsolete. Some overlap or contradict each other. Often, nobody wants to touch them because nobody is sure what will break.

The same problem affects access policies, cloud configurations, segmentation and application controls.

This is where AI can make a real difference. It can analyze policies, find contradictions and unnecessary rules, understand how changes affect other controls and recommend improvements. Over time, AI agents will make many of those changes themselves, within clear boundaries.

There is a catch. A rule that looks unnecessary may support a critical business process. AI needs business context, not just technical configurations. Changes need validation before deployment, rollback capabilities and human approval for high-impact decisions.

We have spent years adding controls and complexity. AI may finally help us manage and reduce that complexity.

Many organizations have built their security environments over years, adding products as new threats emerged. The result is often dozens of tools, each with its own policies, configurations and management requirements.

Keeping everything consistent has become a major challenge. According to Gartner, large enterprises used an average of 45 cybersecurity tools in 2024. AI makes this fragmentation much harder to sustain.

For AI to make good security decisions, it needs context across different security controls. And to take action, those controls need to work together. Fragmented data, policies and management make both much harder.

I expect organizations to consolidate around fewer, broader security platforms. But that doesn’t mean one vendor or a closed ecosystem. Enterprises will continue using specialized technologies, and vendors will need to make interoperability much easier through open APIs, shared standards and integrations that work without extensive custom development.

In 2027, integration will need to be easy, not just possible. AI-driven security cannot depend on dozens of disconnected products.

AI is not just another security tool. It changes the speed of cybersecurity, what we protect, how we manage it and the architecture behind it. In 2027, many of these changes will move from experiments to the way security is done.​​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?