Running software at AI speed:How your operating cadence keeps up when the world won't slow down

To see why this is tipping right now, I have to pull two phases apart. Phase A is the one everybody sees. AI yes or no used to mean: am I able to build competitive software? For me that question is answered: with AI agents you can build faster today. The economic data shows the scale behind it, namely how much capital is flowing into this technology.

In the first half of 2025 alone, AI investment raised US GDP at an annualized rate of 1.3 percent, and the White House compares that to railroad building in the Industrial Revolution. It also asks right away whether a second great divergence is coming (Source: Council of Economic Advisers, 2026). That is a political paper, so feel free to keep some distance from the claim. ING estimates that about a third of US growth in 2026 comes from AI (Source: ING Economics, 2026). The global investment cycle, meanwhile, brings Europe a mean of around 0.10 percentage points of growth in 2026 (Source: Goldman Sachs, cited by Investing.com, 2026).

The job market isn't keeping up. ING calls the effect on jobs modest so far, and US entry-level hiring of graduates sits 17 percent below 2019 (Source: ING Economics, 2026). The growth comes from investment, not from jobs.

Phase B is only just starting, and it asks something else: can you run software? Keep it up, keep it safe, in a world where new holes appear faster than a monthly plan can work through them.

That includes the small company with its home-built app on its own Linux server. Maybe more so, because nobody there reads the advisories at night.

Mandiant, Google's forensics arm, estimates the mean time from patch to first exploitation in 2025 at minus seven days. Minus. So exploitation regularly starts before a patch even exists (Source: Mandiant M-Trends, 2026). VulnCheck counts 28.96 percent of the known exploited flaws of 2025 as attacked on publication day or earlier, up from 23.6 percent in 2024 (Source: VulnCheck, 2026).

And the volume is growing. Vulnerabilities disclosed per month doubled in 2026, from 5,045 in January to 10,740 in August (Source: Google Threat Intelligence Group, 2026). From January to August, 141 flaws were actively exploited, more than in all of 2025 with 127.

Before you read every advisory as an alarm: Google puts this in context itself. Only about 1 in 431 flaws disclosed in 2026 was ever seen being exploited (Source: Google Threat Intelligence Group, 2026). That is the real work: finding, among more than 10,000 advisories, the one that affects you.

What does AI have to do with it?

According to Google, exactly 50 percent of the flaws likely found by AI lead to remote code execution, against 26 percent overall (Source: Google Threat Intelligence Group, 2026). Part of Google's explanation is that research teams aim their agents at critical spots on purpose. So often it is the defenders doing the searching. Once a flaw is disclosed, the other side reads along. In Google's example, exploitation of an AI-found flaw began within four days of publication (Source: Google Threat Intelligence Group, 2026).

It is as if a note went up on the neighbourhood notice board saying which workshop door doesn't close properly. The question is who reads it first.

And the other side stopped searching only by hand a while ago. According to Flashpoint, attackers are building their own models without safeguards on private infrastructure, and even inexperienced ones can use this to send out automated scanners (Source: Flashpoint, 2026). A self-hosted model like that just runs, and it doesn't have to ask anyone's permission. These are intelligent scanners moving through the net.

That leaves two cases. By Google's count, zero-days make up 62 percent of the exploitation observed in 2026, and patching faster doesn't help against those, because no patch exists yet. What remains is what the public bodies did: take the system offline and wall it off. And expose as little as possible to the internet beforehand. But according to Google, the growth comes mainly from flaws that are already known and quickly weaponized (Source: Google Threat Intelligence Group, 2026). And there the time after the advisory matters. That time sits inside your business.

AI-supported doesn't mean AI-abandoned. You can't just say: hey AI, go manage my infrastructure. That is a very bad idea. Of course there have to be people involved who know the trade and know what they are doing, and who watch over these agentic pipelines.

Google recommends a clear basic pattern: away from unfiltered mass patching, toward sorting by real threat, combined with automated, agentic remediation (Source: Google Threat Intelligence Group, 2026). I work with four building blocks, and the fourth belongs to a human.

1. Inventory

An agent keeps the list of what runs at your place: PHP version, framework version, kernel, Node, libraries. No 200-page document, just a list the agent keeps current itself. Without this step the rest doesn't work.

2. Matching

An agent reads security notices and reports of actively exploited flaws and matches them against your inventory. What comes out isn't a flood but an exposure note: “PHP 8.3.30 on server X is affected, the update is 8.3.36, risk: outside code without login, already being actively exploited.” Ready to read.

3. Preparation

The agent prepares the update: branch, version bump, test run in the test environment, report.

4. Decision rights, in advance

Decide in advance which person who knows the trade makes the call and who covers for them, on your team or from outside. They read the note and check the test report. Then they roll out the update at the press of a button, hold it back, or take the system offline if no update exists yet. With a three-day deadline, the note can wait until morning.

No human gets automated away here. Nobody in a small business reads more than 10,000 advisories a month anyway. Now the relevant one arrives, and a human has a clear head for the decision that counts. And running software stays a process you never finish. What that means when the software itself is an AI solution is in the article on LLMOps for small businesses: the day after the demo is the day the work starts.

What this looks like

Take a small agency, made up: three people, twelve client websites on PHP. With a slow operating cadence, someone reads about the flaw in the paper on Monday. Tuesday, someone asks which versions are running. Wednesday the answer comes, Thursday they patch, two sites break, Friday rollback.

With a fast operating cadence, the agent's note arrives Tuesday evening, with all twelve version numbers and prepared updates. Two sites already broke in the test run, and the note says so. Wednesday morning the owner checks and presses ten times. Done by noon, the other two by evening.