McKinsey: cybersecurity in the era of frontier AI, a race against time

By McKinsey & Company · October 11, 2026.

McKinsey is using National Cybersecurity Awareness Month to warn of a growing challenge: in the era of frontier AI, time is the enemy of enterprise cybersecurity teams. The traditional model assumed organizations would have time to detect and fix their vulnerabilities, but according to the email that assumption is now outdated.

The key figure is that critical vulnerabilities can now be actively exploited within hours. As recently as last year, the window was roughly three weeks. The figure is attributed to Benjamin Klein, Charlie Lewis, Rich Isenberg, Venky Anant and other co-authors. The email adds that advances in quantum computing will put these teams under even more pressure.

The technology cuts both ways, however. AI can also help detect and respond to threats faster. It can take over routine cybersecurity work, freeing analysts for higher-value investigations and decisions. In a recent blog post, Lewis and his co-authors explain how public agencies can harness these capabilities while keeping humans in charge of high-consequence actions.

The email links to seven pieces:

- «The speed problem: How frontier AI exposes weakness in enterprise cybersecurity». It argues that attackers move at machine speed while organizations decide at committee speed. To close the gap, it proposes a different operating model and committed executive leadership. - «How agentic AI can transform public sector cybersecurity». It argues that agentic AI could transform the efficiency and effectiveness of public agencies' cybersecurity programs. - «The board's role in managing emerging AI risks». It captures a discussion between cybersecurity executives and board members on the challenges and opportunities of AI. - «Quantum is almost here: Are you and your systems ready?». It describes the quantum threat as the biggest cyber risk in history. It proposes an approach to protecting data and intellectual property, future-proofing digital infrastructure and mitigating risk. - «Securing the agentic enterprise: Opportunities for cybersecurity providers». It states that the rise of agentic AI exposes companies to new cybersecurity risks. That creates opportunities for providers that can make autonomous systems more secure. - «Tech resilience for healthcare providers: Inaction has a heavy toll». It notes that cyberattacks and tech outages at healthcare providers have hit record highs and that robust prevention, detection and recovery plans are needed. - An interview with Kara Sprague, CEO of HackerOne, on how AI is reshaping cybersecurity. She argues that security teams must shift from finding vulnerabilities to reducing exposure.

The email also announces a McKinsey Live event on October 15. Michael Chui and Roger Roberts will discuss the «Technology Trends Outlook 2026» report. They will explore where momentum is building, how major trends are converging and what they mean for executives, workers and society.

The email is an editorial roundup with short descriptions and gives no figures or methodology beyond what is stated. For details, readers would need to consult the original reports.