In the last 24 hours alone, I've seen. 1. iPhone 11 through 16 are apparently vulnerable to remote attacks. 2. SSL certificates are broken until browsers remove eMudhra CA. 3. PHP RCE (php2shell) One is a leaked remote unlock capability for the most common phones on the planet. One is a broken link in the certificate authority system that underpins the entire encrypted web and another is a core language vulnerability that affects a huge fraction of the internet’s servers. This is the pace now. AI does not have to "take over" for the environment to become unmanageable by traditional human processes. It only has to make discovery, weaponisation, and automation faster than the average organisation’s inventory, patching, and monitoring cycle. If your plan was still "wait and see how AI plays out in security," I hope you have loyal religiously loyal customers and a hell of an insurance policy. Inventory what you run (especially PHP and anything that trusts public CAs), prepare to patch at the speed these things now appear, and start treating AI-assisted detection and response as table stakes rather than a future project. The window for comfortable observation is closed.