Rapid7’s latest Q3 analysis, as reported by SecurityWeek, indicates that high-severity vulnerabilities were exploited within an average of three days, while ransomware remained the dominant pattern across the incidents it tracked. The same report said AI-related activity appeared in only 8% of those incidents.

Although the findings come from one security vendor’s incident dataset rather than a complete picture of all cybercrime, the business message is clear: organisations may have less time than they expect to react once serious software flaws become known.

What happened

According to SecurityWeek’s summary of Rapid7’s Q3 analysis, attackers exploited high-severity vulnerabilities in an average of three days. The report also said ransomware continued to account for a large share of tracked incidents.

The reference to AI appearing in 8% of incidents is also notable. It suggests that, in Rapid7’s observed cases, established cyber risks such as unpatched systems, exposed services and ransomware operations remained more operationally significant than headline-driven concerns about AI-powered attacks.

Why it matters for European businesses

For European companies, especially SMEs with limited security staff, a three-day exploitation window is a practical warning. Businesses often rely on monthly patching cycles, overstretched IT teams or external providers that may not be able to remediate critical issues immediately. If attackers are moving within days, delayed patching can create a direct exposure to ransomware, service disruption and data compromise.

This matters beyond IT downtime. A ransomware incident can interrupt e-commerce operations, customer support, order processing, finance systems and marketing platforms. If personal data is affected, organisations may also face GDPR-related reporting and response obligations depending on the circumstances. For companies in sectors covered by stricter cybersecurity expectations, faster exploitation timelines also raise pressure on vulnerability management and incident readiness.

The report is also a useful corrective for businesses allocating security budgets. While AI security deserves attention, many organisations may gain more immediate risk reduction from improving basic cyber hygiene: patching, asset visibility, multi-factor authentication, backups and response planning.

Who may be affected

• SMEs that depend on small internal IT teams or outsourced support and cannot patch critical systems quickly.
• E-commerce businesses whose websites, plugins, cloud platforms or payment-related systems may become targets soon after vulnerabilities are disclosed.
• Marketing and digital teams managing CMS platforms, landing pages and third-party tools that can expand the external attack surface.
• IT and security teams responsible for internet-facing systems, remote access services, identity platforms and endpoint protection.
• Regulated organisations that may face higher operational and reporting pressure after a ransomware or data-security incident.

What companies should consider

• Shorten patching timelines for critical flaws. Review whether current processes can support emergency updates outside normal monthly cycles.
• Prioritise internet-facing assets. Systems exposed to the public internet, including VPNs, firewalls, remote administration tools, web servers and CMS platforms, typically require the fastest response.
• Improve asset visibility. Many organisations struggle to patch quickly because they do not have a complete inventory of public-facing systems, cloud services and software dependencies.
• Prepare specifically for ransomware. Test backups, isolate backup infrastructure where possible, and confirm that recovery processes work under realistic conditions.
• Review third-party responsibility. If websites, hosting, SaaS administration or security operations are outsourced, clarify who monitors critical advisories and who is authorised to act immediately.
• Strengthen detection and containment. Faster exploitation means businesses need not only patching but also monitoring for suspicious access, privilege escalation and unusual encryption activity.
• Keep AI risk in proportion. Do not ignore AI-related threats, but align security investment with the incidents most commonly causing operational damage today.

For European business leaders, the immediate lesson from Rapid7’s Q3 findings is not that every new flaw will lead to compromise, but that the margin for delay is shrinking. In practice, resilience increasingly depends on whether a company can identify critical exposures, patch rapidly and respond before ransomware operators gain a foothold.