Blog entry by Seán Lea
When a security flaw in widely used software becomes public, a race starts. The supplier has to fix it and roll the fix out. Attackers want to use the flaw before that happens. For most of the last decade, suppliers had weeks to win that race. That time has almost gone, and AI is one of the reasons.
If your business rents its software rather than running it – your LMS, your HR system, your accounts package – you are not in that race yourself. Your supplier runs it for you. This post explains what has changed, what we do about it at SkillsCircle, and five questions to put to any supplier that holds your staff data.
In short
- Attackers now use a new flaw, on average, a week before a fix exists.
- If you rent your LMS, your supplier fixes flaws for you. Their speed is your risk.
- Five questions show which suppliers keep pace. They are at the end of this post.
The gap between "known" and "attacked" has closed
Google's Mandiant team has tracked time-to-exploit for years: the average time between a fix being released and attackers using the flaw. A negative number means attackers got there first. In 2018–19 the average was 63 days. Across 2021 and 2022 it was 32 days. In 2023 it was 5 days (Mandiant). In M-Trends 2026, Mandiant estimates the 2025 figure at minus 7 days. On average, attackers now use a flaw a week before a fix exists.
Average time from fix to attack
63 days
2018–19
32 days
2021–22
5 days
2023
−7 days
2025 estimate
Source: Google Mandiant. A negative number means attackers acted before the fix existed.
The National Cyber Security Centre (NCSC) expects AI to push this further. Its assessment of AI and the cyber threat to 2027 says:
The time between disclosure and exploitation has shrunk to days and AI will almost certainly reduce this further.
In the NCSC's scale of likelihood, "almost certainly" is the strongest judgement it makes.
Research shows why. In 2024, university researchers gave an AI agent the public descriptions of 15 real flaws. It wrote working attacks for 87% of them. Without the descriptions, it managed 7% (Fang and others, 2024). In 2025, two security researchers described a system that turned newly published flaws into working attack code in 10–15 minutes, at about one dollar each (their write-up).
The lesson is simple. The public description of a flaw is now most of what an attacker needs. A fix that waits for next month's maintenance window may arrive after the damage is done.
Why this is your problem, even if you never patch anything
Most small businesses do not run their own LMS servers. You log in to a service and someone else maintains it. That is sensible. It moves the risk, though. It does not remove it.
The government-backed Cyber Essentials scheme is clear about who owns what. For software as a service, security updates are the cloud provider's job, not yours (Cyber Essentials requirements v3.3). The same document sets the standard for your own devices: updates that fix high-risk or critical flaws go on within 14 days of release. That is a useful yardstick for any supplier. Against a time-to-exploit of minus 7 days, it is also a generous one.
In May 2026 the NCSC's chief technology officer warned of a coming "vulnerability patch wave": a rush of fixes as AI exposes old weaknesses across all kinds of software, software as a service included. His advice to organisations of every size was to update by default and to gain assurance from their supply chains. On 3 November 2026 the NCSC's chief executive put it more bluntly:
Vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.
Your LMS holds names, email addresses, job roles and training records for every member of staff. If that data leaks, you are the data controller. The questions land on your desk, not your supplier's.
Defenders have the same tools
The NCSC's assessment has good news in it too. AI "will also aid system owners and software developers in securing systems." The same tools that read a flaw description and write an attack can read a codebase and find the flaw first.
The NCSC does not expect everyone to use them. It judges that there "will almost certainly be a digital divide between systems keeping pace with AI-enabled threat, and a large proportion that are more vulnerable."
That divide runs between software suppliers as much as anywhere. Some now point AI at their own code automatically and fix what it finds. Others still wait for a researcher, a customer or an attacker to tell them. From the outside, both look the same: a login page and a padlock in the browser. The only way to tell them apart is to ask.
What separates them is automation. A flaw that a machine check finds this week can be fixed before a manual review would even start.
What we do at SkillsCircle
SkillsCircle is built and run by Accipio. We would rather show our working than ask you to take security on trust, so here is what happens behind your login page. We describe types of issue, never specific flaws. Publishing those would help the people we defend against.
One principle runs through all of it: automate. Attackers now work at machine speed. A person who checks things when they have time cannot keep up. So wherever we can, a machine does the checking and a person makes the fix.
390+
security and hardening changes merged since July 2026, across Accipio's software and the platform SkillsCircle runs on
Automated security sweeps
AI tools review our code for the mistakes attackers hunt for: unsafe database queries, missing permission checks, data shown on screen before it is made safe, and others like them. Each sweep produces a round of fixes. Then the sweep runs again on what has changed, and each round finds less. We are moving these sweeps onto a monthly schedule, and then to weekly or daily, so that new code is checked soon after it is written.
Hardening, layer by layer
Hardening means closing doors before anyone finds them open. We have hardened the operating system, database and web server that our sites run on, with tighter settings and safer defaults, so that a future mistake does less harm. We are also adding automatic blocking of traffic from known malicious IP addresses.
Updates that apply themselves
Our servers apply security updates to outward-facing packages and services automatically. We monitor security advisory feeds, so we hear about a newly published flaw when it is announced, not at the next scheduled review. We treat the most serious fixes as urgent, and we keep our Moodle sites on the latest release or the one before it.
Fewer third-party parts, each one checked
Moodle has a large ecosystem of add-on plugins, written by many different developers. Each one is more code that can go wrong. Our upgrade process now checks every installed plugin automatically against published vulnerability records, and flags any that are not in use. We are removing what is not needed, and we set a high bar for anything new. A plugin with a known critical flaw does not go on.
Supply-chain checks
Modern software is also built from thousands of open-source parts, and attackers now poison those parts at the source. In May 2026 a campaign known as "Mini Shai-Hulud" planted malicious code in widely used JavaScript packages (NHS cyber alert). On 19 May an automated check compared 210 lockfiles – the files that record exactly which version of each part a project uses – against 373 package versions known to be compromised. It found none.
Independent checks
Accipio is certified to ISO 27001, the international standard for managing information security, and holds Cyber Essentials Plus. Each organisation on SkillsCircle gets its own isolated tenant, hosted in the UK.
None of this makes us immune. No supplier is. It does mean we look for our own flaws with the same tools attackers use, automatically, and fix what we find. If something does go wrong, we follow a documented incident response policy and tell affected customers without undue delay, as UK GDPR requires.
Five questions to ask any LMS or SaaS supplier
You do not need technical knowledge to ask these. You only need to notice whether the answer is specific.
1. How do you find security flaws in your own code, and how often?
A good answer names methods and a schedule: automated code scanning, AI-assisted audits, and how often each one runs. Ask how much of it is automated. Checks that wait for someone to have time fall behind. A weak answer is "we've never had a problem". That usually means nobody is looking.
2. How quickly do you apply a fix for a critical flaw?
Ask for a target in days. Cyber Essentials expects 14 days for high-risk and critical updates on your own devices. Given how fast flaws are now exploited, a strong supplier should aim well inside that. Ask whether security updates apply automatically. If the answer is "in our next release", ask when that is.
3. How do you check the third-party code your product depends on?
Every modern product relies on open-source parts. Ask how the supplier would know if one of those parts was compromised, and how quickly they would check. Recent supply-chain campaigns show this risk is real, not theoretical.
4. If something affects our data, how and when will you tell us?
Under UK GDPR, a supplier that processes personal data for you must tell you "without undue delay" after it becomes aware of a personal data breach (Article 33(2)). Where a breach is likely to put people at risk, you then have 72 hours, where feasible, to report it to the regulator (Article 33(1)). So ask who will contact you, by what route and how fast. Then check that the contract says the same thing.
5. What independent evidence can you show?
Claims are cheap. Certificates are not. Ask for current ISO 27001 certification, and check that its scope covers the service you are buying. Ask about Cyber Essentials Plus too. Unlike basic Cyber Essentials, it includes a hands-on technical check by an independent assessor.
Supplier security is half the picture. The other half is your own staff, who now receive phishing emails written by the same AI tools. Our cyber security awareness checklist covers that side.
The speed has changed, so the questions should too
A few years ago, a supplier that patched within a month was doing fine. Today the same supplier may be weeks behind the attackers. When you choose an LMS, security sits alongside content, price and ease of use – our guide to what makes a good LMS for a small business and our 2026 buyer's guide cover the rest.
Put these five questions to us
Ask us any of them. Or take the fit check to see whether SkillsCircle suits your organisation.