Cybersecurity costs are rising as attacks spread faster and exploit more types of systems. Companies are turning to AI for around-the-clock monitoring and patching, while the growing pace of vulnerabilities is increasing pressure on IT teams to respond quickly.
Nearly 37,000 software and system vulnerabilities were reported in the third quarter of 2026, triple the year-earlier tally, according to the Common Vulnerabilities and Exposures registry. Executives say incidents that once arrived months apart now occur weekly or even every few days.
That tempo has a direct operational cost. Ahold Delhaize, the Dutch grocer behind Stop & Shop and Giant Food in the United States, lost more than €200 million ($225 million) in sales after a mid-October intrusion forced it to take its websites and apps offline for a week. The company also had stores in Belgium and Luxembourg affected by a separate wave of refrigerator attacks across 12 European countries.
“We’re adjusting to a new reality,” CFO Jolanda Poots-Bijl told Reuters. Smaller companies are especially exposed, she said, while AI can help identify incidents and restore systems faster.
Security budgets shift toward automation
The scale of the exposure is drawing spending toward security products and services. McKinsey expects the market for cybersecurity offerings from outside vendors to rise from $223 billion in 2025 to $346 billion by 2029.
Companies are investing in tools designed to reduce the time between detecting a threat and closing a weakness. German hosting provider Ionos, which serves seven million customers, expanded AI-based monitoring after a July spike in vulnerabilities. It also uses AI-assisted systems to install patches around the clock.
“I’m kind of limited to what a nine-to-five office hours team can do and that’s no longer good enough,” Ionos Chief Technology Officer Markus Noga said.
Booking.com is also building AI-powered defenses, with hundreds of engineers working on the systems, according to Chief Security Officer Marnie Wilking. The company faces attackers who shift tactics before fixes are fully deployed. “It’s a never-ending game of cat and mouse, with very high stakes,” she said.
Other organizations are expanding defensive efforts. Binance, which suffered a cryptocurrency theft valued at $6.3 billion, said it would increase investment in AI-enhanced detection. The Port of Rotterdam is developing an AI-powered “cyber shield,” and Siemens is testing advanced AI models for security.
Vulnerabilities can become operational incidents quickly
The attacks on supermarket refrigeration systems show how a weakness in connected equipment can disrupt physical operations. In the second such incident within three weeks, hackers raised refrigerator and freezer temperatures, leaving retailers to discard millions of dollars’ worth of spoiled food.
Claroty had published research in August describing weaknesses in refrigeration controllers. After attacks first hit stores in France on October 11, researchers used widely available AI tools to reproduce the flaws and take control of a test device. Claroty field CTO Sean Tufts said the work took “six dollars and 28 minutes.” The result illustrates how inexpensive and fast it can be to test a known weakness once researchers identify it.
The same compression of discovery and response time followed disclosure of two AI-discovered flaws in PHP on October 21. The programming language supports many websites, and organizations from Tokyo to Helsinki took sites offline as a precaution. Cloudflare said attempts to exploit the flaws surged from thousands to millions within hours of disclosure, and warned that AI-discovered bugs could cause further disruption.
Swiss building materials company Holcim took its website offline at about 9:30 p.m. on October 21 to apply PHP fixes, restoring service before midnight. CFO Steffen Kindler said companies need to improve their defenses as attackers adopt similar tools: “Both sides are heavily equipped. Both sides use AI, and that race is continuing.”
Kraft Heinz CEO Steve Cahillane described cybersecurity as increasingly important, saying it mattered more that day than the day before and would matter still more the next day. For companies, the practical pressure is immediate: shorten the interval between vulnerability disclosure, assessment and remediation, while keeping critical services available.
