The Patch Window Is Now Measured in Hours
AI-assisted exploit development has collapsed the time between disclosure and mass exploitation. Traditional vulnerability management workflows weren't built for this pace.
Key points
- The gap between CVE disclosure and active exploitation is now measured in hours, not days.
- AI tools let attackers read patch diffs and reproduce working exploits faster than human researchers working alone.
- Botnet operators ingest public proof-of-concept code automatically, often before a Tuesday advisory reaches inboxes.
- Monthly patch cycles and CVSS-driven queues are now lagging indicators, not management tools.
- Compensating controls before patches land are becoming standard practice in mature shops.
The gap between a CVE landing on a vendor advisory page and indiscriminate exploitation hitting the internet is no longer a comfortable two-week window. Hours is closer to the truth.
What has AI changed about exploit development?
Attackers are using large language models to read patch diffs and reproduce working exploit code faster than human researchers ever managed alone. Weaponization used to take skill and time. Both are now optional for a meaningful slice of disclosed bugs, particularly memory-safety issues in widely deployed network appliances and authentication bypasses in edge devices.
Patch diffing is now a commodity task. Feed a binary diff into a capable model and ask it to describe the security-relevant changes. The output is rough, but it's a starting point that used to take a senior researcher a full day.
Public proof-of-concept code propagates within minutes of being posted. Scanners maintained by botnet operators ingest it automatically. By the time a Tuesday advisory hits inboxes, opportunistic scanning is already running against affected IP space.
We first covered this compression of attacker timelines on 28 May 2026, when India's CERT-In mandated 12-hour patch windows for internet-facing systems, citing exactly this dynamic. The regulation looked aggressive then. It looks prescient now.
Should you worry about CVSS scores?
Severity scoring and CVSS-driven prioritization queues are lagging indicators. By the time a CVE appears in CISA's Known Exploited Vulnerabilities catalog, exploitation has often been in flight for days. The catalog is useful for accountability, not triage speed.
Defenders in mature shops are responding with two concrete shifts: pre-disclosure monitoring of vendor advisory feeds, with automated ticketing the moment a CVE matches an asset inventory entry; and compensating controls deployed before patches land, covering WAF rules, egress filtering and temporary service exposure cuts.
Neither is glamorous. It's plumbing. The plumbing is what determines whether a disclosed bug in your edge appliance becomes a Monday morning incident.
What should defenders actually do?
Maintain an authoritative asset inventory keyed to vendor product identifiers, not hostnames. CVEs are issued against products, and a hostname-based inventory misses the match.
Subscribe directly to vendor PSIRT feeds. Don't wait for aggregators.
Define a patch SLA for internet-exposed assets with a known public exploit that is measured in hours, not days. Monthly patch cycles and quarterly scan cadences have run out of road for this class of vulnerability.
Rehearse emergency patching. The first time your team runs an out-of-cycle deploy under pressure should not be during an active campaign.
Vulnerability management as a discipline isn't dead. The version of it built around 30-day windows is.
