For three decades, vulnerability management ran on a hidden buffer: the weeks or months between a flaw being discovered and an attacker working out how to weaponize it. The recipe was simple. Triage by severity, schedule the fix, validate, move on. That buffer is what made the recipe work, and it is now gone. The discipline built on top of it is breaking in public.
The window collapsed from months to hours
The shift did not come from defenders getting slower. It came from the other side of the equation. According to reporting in The Hacker News, AI has compressed the path from discovery to working exploit from months to hours, and the figures are hard to wave away. In its May 2026 update, Anthropic reported that it and roughly 50 partners used a gated model it calls Claude Mythos to find more than 10,000 high or critical severity vulnerabilities in systemically important software in a single month.
Pointed at Firefox, the same model wrote 181 working exploits, against just two from the previous frontier model. It surfaced flaws across every major operating system and browser, including an OpenBSD bug that had sat undetected for 27 years. At the time of reporting, more than 99% of what it found was still unpatched. Offense does not even require novel bugs: a cited AWS threat-intelligence report described an actor running offensive tooling autonomously through a custom server, confirmed across more than 600 devices in 55 countries, with researcher logs suggesting the campaign queued thousands more.
How we got here
Vulnerability management was designed for human-paced offense. CVSS scoring, monthly patch cycles, and quarterly remediation targets all assume that turning a disclosed flaw into a reliable exploit takes specialized skill and time, which gave defenders a queue they could realistically work down. AI removed that assumption on the offense side first, and not by accident: writing an exploit is precisely the kind of constrained, well-specified coding task that large models do well. The result is that the most labor-intensive step in the attack chain, the one defenders implicitly relied on as a speed bump, is now close to free.
Severity triage was built for a slower world
The practical damage is to prioritization. Severity scoring assumes you can rank a queue and work down it before most of the queue becomes dangerous. That held when time-to-exploit was measured in weeks. The Zero Day Clock now puts the 2026 average at roughly 24 hours, down from about 53 days in 2024, and Verizon’s 2026 Data Breach Investigations Report ties almost a third of initial-access techniques to vulnerability exploitation, a share it expects to climb. When the gap between published and exploited is a single day, a ranked backlog is not a plan, it is a hope.
Regulators have already conceded the point
The clearest admission that the old cadence is dead came from the government. As we reported, CISA’s Binding Operational Directive 26-04 now requires federal civilian agencies to remediate the highest-risk vulnerabilities in as little as three days. A three-day mandate is not a scheduling tweak. It codifies that an exploited vulnerability is an active incident, not a maintenance item, and CISA directives have a long record of becoming the benchmark that insurers and enterprise contracts quietly adopt.
The supply chain is the same story from a different angle
The trust model is being rewritten upstream too. GitHub’s move to disable npm install scripts by default in version 12 inverts a default that stood for years, shifting the ecosystem from trust everything unless you opt out to trust nothing unless you opt in. Read next to the AI-speed exploitation data, the pattern is unmistakable: defenders are revoking implicit trust everywhere it used to be granted, because the cost of a wrong assumption now compounds in hours rather than quarters.
What validation actually changes
The alternative to patching faster than is humanly possible is to stop assuming and start testing. Breach-and-attack simulation continuously fires real adversary techniques at your own controls to see what actually gets through, rather than inferring safety from a patch report. Exposure management reprioritizes work by what is genuinely reachable and exploitable in your specific environment, not by raw CVSS in the abstract. The shift is subtle but decisive: from a backlog of everything labeled critical somewhere, to a much shorter list of what is critical here, now, and demonstrably exploitable against you.
What it means for the security leader
If time-to-exploit is measured in hours and the patch mandate in days, patching alone cannot be the primary control. It is inherently reactive, and the window is now shorter than most change-management processes can move. The center of gravity is shifting from remediation to validation. That is the logic behind budget moving toward breach-and-attack simulation, exposure management, and aggressive segmentation. Microsoft’s June 2026 Patch Tuesday, a record of roughly 206 fixes including multiple exploited zero-days, makes the volume point on its own: no human team triages that fast by hand.
None of this means patching is pointless. The honest reframing is narrower and harder. Are we patched is no longer a sufficient question, because the answer is always not completely, and not fast enough. The better question is: if this is exploited in the next 24 hours, does anything we have already deployed stop it, and would we even know.
What to evaluate now
Brief your board on mean-time-to-contain, not mean-time-to-patch. Ask whether your exposure is validated continuously or merely assumed from a scanner report. Pilot breach-and-attack simulation against the specific techniques in current threat intelligence, not a generic checklist. Inventory which build pipelines depend on npm install scripts before version 12 ships and breaks them. And pressure-test the assumption baked into most programs, that you will have time to react. On the current numbers, you will not, and the programs that survive the next two years will be the ones that planned for that now.
