AI Is Shrinking the Time Between Bug and Break-In. Playbooks Haven't Caught Up.
Vendors are pitching AI-driven vulnerability tools like Mythos as the answer. The harder question is what defenders have been doing wrong for years.
Key points
- Security teams say the window between a flaw being disclosed and criminals exploiting it is shrinking fast, driven in part by AI tools that help attackers write working exploits.
- Mythos, a new AI-assisted vulnerability platform being discussed across the industry, is one of several products claiming to help defenders keep up.
- Vulnerability management, the routine work of finding and fixing software flaws before criminals use them, has long suffered from a backlog problem, not just a speed problem.
- Patching every flaw is impossible for most organisations; the real fight is deciding which handful actually matter this week.
- Buying an AI tool will not fix a process that was already broken before AI showed up.
There is a conversation running through security teams right now, and it goes roughly like this. AI is making it faster for attackers to turn a newly published flaw into a working break-in. Tools like Mythos, an AI-assisted vulnerability platform, are being marketed as the counterweight. The vulnerability management playbook, meaning the standing plan a company uses to find, prioritise and patch software flaws, is due a rewrite.
That framing, as first raised by The Hacker News, gets the question right. It does not answer it.
What is actually changing?
The time between a flaw being made public and criminals using it in the wild is collapsing. Where defenders once had weeks to test and roll out a patch, some flaws are now weaponised in days, occasionally hours. AI coding assistants (the same kind office workers use to write emails) can help an attacker turn a vague advisory into functional exploit code much faster than before.
This is not hypothetical. Researchers have publicly demonstrated large language models producing working exploits from CVE descriptions alone, given the right prompting and access to the vulnerable software.
So does the playbook need to change?
Yes, but not in the way vendors are selling it. The core failure in most vulnerability programmes is not detection speed. It is prioritisation and follow-through.
A typical enterprise scanner will flag tens of thousands of findings per month. The security team cannot patch them all. They never could. What matters is whether the handful that are actively being exploited, or trivially exploitable and internet-facing, get fixed this week rather than next quarter.
AI can help sort that pile. It cannot make a change-management board move faster, and it cannot make a business owner agree to a Saturday reboot.
Where AI-assisted tools genuinely help
There are real gains on offer. Ranking flaws by likelihood of exploitation, drafting the internal ticket, summarising a vendor advisory into plain English for the team that owns the server: all of this is honest, useful automation.
The risk is treating the tool as the strategy. A company that could not patch a two-year-old flaw in its VPN before buying an AI platform will not suddenly patch it after.
What defenders should actually do
Start with the boring questions. Which of your systems are exposed to the internet? Which run software the vendor no longer supports? Who, by name, is responsible for patching each one? When a critical flaw drops, how many hours pass before someone with authority to reboot production is in the room?
Most organisations cannot answer these cleanly. That is the gap AI will not close for you.
| Playbook element | Traditional approach | What AI actually changes |
|---|---|---|
| Flaw discovery | Scheduled scans | Faster triage of scanner output |
| Prioritisation | CVSS score sorting | Exploit-likelihood ranking |
| Patch decision | Change board, weekly | Same board, same week |
| Response time | Days to weeks | Hours, if the process allows |
Common questions
Is AI making attacks faster than defenders can respond?
In narrow cases, yes. AI is speeding up the writing of exploit code, but most successful attacks still rely on unpatched flaws that have been public for months or years, which is a process failure, not a speed failure.
Should a small business buy an AI vulnerability tool?
Not as a first step. A small business gets more security from an accurate inventory of what it owns, automatic updates turned on, and a written plan for who patches what, than from any AI platform.
