The Patch Window Is Now Measured in Hours
AI-assisted exploit development has collapsed the time between disclosure and mass exploitation. Traditional vulnerability management workflows weren't built for this pace.
The gap between a CVE landing on a vendor advisory page and indiscriminate exploitation hitting the internet is no longer a comfortable two-week sprint. It's hours.
AI-assisted exploit development is the reason. Attackers are using large language models to read patch diffs, reproduce proof-of-concept code, and generalize exploitation primitives faster than human researchers ever managed on their own. The asymmetry is structural, and it isn't reversing.
The old vulnerability management playbook assumed friction on the offensive side. Reverse engineering took skill. Weaponization took time. Both assumptions are now obsolete for a meaningful slice of disclosed bugs, particularly memory-safety issues in widely deployed network appliances and authentication bypasses in edge devices.
What changed operationally? Three things worth naming.
First, patch diffing is now a commodity task. Feed a binary diff into a capable model and ask it to describe the security-relevant changes. The output is rough, but it's a starting point that used to take a senior researcher a full day.
Second, public PoCs propagate within minutes of being posted. Scanners maintained by botnet operators ingest them automatically. By the time a Tuesday advisory hits inboxes, opportunistic scanning is already running against the IP space that hosts the affected product.
Third, defenders are still operating on monthly patch cycles. The mismatch is what's breaking vulnerability management as a discipline.
The practical implication for security teams is that severity scoring and CVSS-driven prioritization queues are lagging indicators. By the time a CVE shows up in CISA's Known Exploited Vulnerabilities catalog, exploitation has already been in flight for days or weeks.
A few shifts are emerging in mature shops:
- Pre-disclosure monitoring of vendor advisory feeds, with automated ticketing the moment a CVE matches an asset inventory entry.
- Compensating controls deployed before patches land — WAF rules, egress filtering, temporary service exposure cuts — rather than after.
None of this is glamorous. It's plumbing. But the plumbing is what determines whether a disclosed bug in your edge appliance becomes a Monday morning incident.
What defenders should actually do
- Maintain an authoritative asset inventory keyed to vendor product identifiers, not hostnames. CVEs are issued against products.
- Subscribe directly to vendor PSIRT feeds. Don't wait for aggregators.
- Define a sub-24-hour SLA for any vulnerability affecting an internet-exposed asset with known exploitation or a public PoC.
- Rehearse emergency patching. The first time you do an out-of-cycle deploy under pressure should not be during an active campaign.
The vulnerability management function isn't dead. But the version of it built around 30-day patch windows and quarterly scan cadences has run out of road.
