Special ── 2026-10-26

EY: AI Vulnerability Discovery Reshapes SOC Reports in 5 Areas

EY says AI vulnerability discovery demands deeper evidence in SOC reports

What changes

Service organizations can no longer show trust merely by having a vulnerability management program. According to EY, they need to explain, with evidence, how that program has adapted to AI-driven threats.

EY expects more follow-up questions and supplementary testing from clients and auditors. A SOC report is a report in which an auditor examines a service organization's internal controls.

EY also says boards and audit committees are pressing leaders on how their service providers address AI's ability to swiftly detect and exploit overlooked weaknesses.

Why it matters

According to EY, the latest generation of AI systems can reason across software. They can combine multiple low- and medium-severity findings into credible end-to-end compromises in minutes or hours.

EY describes the long-standing vulnerability management model as identifying weaknesses, prioritizing by risk, patching or compensating, and reporting through governance. It says the pace of that cycle was governed largely by human factors, and that AI is rewriting that equation.

EY therefore argues that having traditional SOC reports and no major incidents may no longer be adequate assurance that software is reasonably secure.

What the report says

EY argues that AI is compressing how vulnerabilities are discovered and combined, which challenges long-standing approaches to managing and reporting risk. Clients and auditors, it says, are demanding deeper evidence.

EY names five focus areas under increased scrutiny: vulnerability management, patch management, secure software development, vendor risk management and penetration testing.

On patching, EY says cycles measured in weeks or months for critical exposures may no longer be acceptable, and organizations should work toward days. On penetration testing, it recommends layered programs rather than an annual external test alone. These combine continuous automated validation, periodic human-led deep dives, red team exercises and pre-production assessments.

EY predicts that future SOC reports will reflect continuous control validation and more granular testing.

Who and what scope

The report is an EY article, written by EY's Cathy Cobey and Jaime Kipnes.

It addresses service organizations, meaning companies that build, host and operate systems for customers. It is not a survey limited to one country or industry.

A related-article blurb cites an EY study finding that 36% of assets in organizations are vulnerable to cybersecurity threats. The article does not state how many organizations or which regions that study covered.

Why this report

The article follows EY's cyber study, Cybersecurity resilience for frontier AI vulnerabilities, which explores how frontier AI is changing the vulnerability landscape.

Its question is how service organizations can show, through SOC reporting, that their controls are adapting in practice. EY says expectations are shifting among clients, regulators and service auditors.

How they studied it

The article does not describe a research method. It gives no sample size or survey period.

It is an analysis and set of recommendations from EY professionals. EY cites standard-setting commentary as pointing to more granular procedures, deeper testing and lower tolerance for high-level control descriptions.

Key points

1. EY says AI can combine low- and medium-severity findings into compromises within minutes or hours.
2. EY expects greater scrutiny in five areas, including vulnerability management and patching.
3. EY recommends three actions: assess controls, strengthen evidence, and align stakeholder messaging.

Conclusion

EY argues that AI has sped up how vulnerabilities are found and combined. In its view, SOC reports will need more granular controls and continuous validation. EY says organizations that can evidence control effectiveness and communicate evolving risk clearly will be better placed to keep stakeholder confidence.

Quotes and sources

“The latest generation of AI systems can reason across software, combining multiple low- and medium-severity findings into credible end-to-end compromises in minutes or hours.”

── EY, 2026-10-23

“Patching cycles measured in weeks or months for critical exposures may no longer be acceptable; service organizations should be working toward cycles measured in days, with clear governance for exceptions when patching is unfeasible.”

── EY, 2026-10-23

“Future SOC reports will increasingly reflect continuous control validation, more granular testing and clearer articulation of how vulnerabilities are identified, prioritized and remediated.”

── EY, 2026-10-23

Source articles

• EY 23 Oct 2026

Written by AI (Claude) from the report and its coverage, then checked by Jev (TypeSafe's judgement model), a Gemini fact-check and a verbatim check of every quote.