3 Sep 2026
This warning, published by OpenAI and signed by many of the world’s largest technology and financial companies, isn’t really about any new type of attack, but instead highlights the reduction of time between a weakness appearing and it being exploited. That “defenders’ window” has always existed, but with the advent of agentic tools, which are able to act autonomously & constantly without breaks, that window has shrunk to the point where periodic review can no longer be relied on to catch it in time.
A penetration test every three to six months, with a security review typically following close behind on the same schedule. These exploits still existed, but attackers were moving at roughly the same pace as the reviews. Now, the rise of autonomous AI is pushing systems to change at a far more continuous and rapid pace – and our security checks need to match it.
This is why we believe organisations need to move to a model of ongoing assurance, rather than periodic assurance. At Atomic, that means continuous AI security testing and auditing – a team of AI agents trained specifically to probe defences for vulnerabilities. They test through the same vectors an attacking system would: configuration, permissions, edge cases that get missed when testing is done in isolation. Because they’re fast, they can run continuously – or much more regularly – and because findings are ranked by a deterministic severity system, teams always know what actually needs attention before the next cycle starts.
This isn’t just our own position, the letter itself calls on security companies to “test defenses continuously,” and that’s exactly the gap continuous AI testing is built to close. We’ve already seen this catch vulnerabilities that traditional testing misses. In one recent review, we found three findings across three separate areas of a system, each one individually assessed as a low risk item on its own. Looked at together, they formed a much more serious vulnerability – the kind of gap that only becomes visible when you’re testing the system as a whole rather than component by component or vendor by vendor.
Human led testing will always bring a high level of judgement, depth, and a deep level of context for why the system works the way it does. Continuous AI testing gives you constant coverage and speed; human led testing gives you the depth to catch what only experience can find. For organisations serious about security, we recommend both, working together rather than one instead of the other.
And this responsibility doesn’t stop at your own systems. Most organisations today are only as secure as the weakest link in the chain of tools and vendors they depend on. That means asking real questions of your suppliers – whether bespoke software modules or SaaS – about what security reviews they’re running, what standards they’re following, and how often. Security is everyone’s responsibility across that chain, not something any single party can individually own.
The organisations that treat this seriously now, while the window for action is still open, will be in a much stronger position than those who wait for the next scheduled review to tell them what’s already gone wrong. Cyber defence needs to move from an item done once a quarter, to a continuous, board-level priority – and that shift starts now.
