Inside the AI Vulnerability Gap: A Security Leader’s Read on the 2026 Report

Azul surveyed 300 security leaders on how fast attackers can exploit a disclosed flaw, how fast teams can fix it, and what slows them down. The AI Vulnerability Gap Report puts numbers on the gap.

In this live conversation, Azul CMO Andrew Savitz sits down with John Stuart, who leads security at Azul, to get his take on the report’s key findings: why the numbers look the way they do, and what a security team can do about them. Live Q&A follows.

What You’ll Learn:

• Why patching takes longer than the attack window. Why 44% of security leaders say their organizations need four days or more to deploy a critical fix, when 69% believe an attacker needs three days or less, and how a security leader reads that gap.
• What testing really costs. Why 58% say pre-deployment testing adds four or more days to every Java runtime patch, and how a security leader weighs the risk of a bad patch against the risk of waiting.
• Why best effort is hard to defend. Why 66% of organizations have no time-bound commitment to patch non-critical vulnerabilities, and what a security leader would put in its place.
• What cannot be seen cannot be patched. Why 51% of security leaders report partial or limited visibility into their critical Java runtimes, and how a team finds what it is missing.
• Where to focus next. Where security leaders plan to focus over the next 12 months.

Who should attend:

• Security leaders who need to explain patch speed to a board or an audit committee
• AppSec, SecOps and DevSecOps leaders weighing testing time against exposure time
• Teams responsible for Java runtimes who are unsure how many instances they cannot see