Cybersecurity teams face a structural shift in vulnerability management. Generative AI and automated scanning engines are accelerating threat research, enabling automated tools to surface and weaponise software flaws faster than humans can.
Data from the 🔗CrowdStrike 2026 Global Threat Report underscores the reality of this machine-speed threat landscape:
- 29-Minute Average Breakout Time: The average time for an adversary to move laterally from initial access to other systems dropped to just 29 minutes (down 65% from 2024), with the fastest recorded breakout taking a mere 27 seconds.
- 42% Increase in Pre-Disclosure Exploitation: Zero-day vulnerabilities exploited prior to public disclosure rose sharply, with newly disclosed flaws routinely weaponised within days.
- 89% Increase in AI-Enabled Attacks: Adversaries leverage AI to automate reconnaissance, craft convincing lures, and shorten the time between initial access and impact.
- 40% Edge Device Target Rate: State-nexus adversaries heavily prioritised internet-facing edge devices, with 67% of exploited flaws providing immediate system access upon execution.
For years, the standard playbook was simple: find vulnerabilities, then patch them. But trying to out-patch AI-driven discovery is a losing game. The conventional race to zero open CVEs is an operational impossibility.
The answer isn’t patching faster; it’s shifting from a volume-based mindset to a risk-managed defence. Security leaders should prioritise patching systems exposed to remote, unauthenticated, zero-click attack techniques.
The Flaw of “Patching Everything Faster”
When AI accelerates discovery, traditional metrics like Mean Time to Patch (MTTP) break down. Security operations centres (SOCs) and IT operations are inundated with critical-severity alerts. Applying every patch indiscriminately leads to three major issues:
- Burnout and Alert Fatigue: Security and IT teams waste cycle time testing and deploying patches for internal, isolated systems that pose minimal external threat.
- Operational Downtime: Rapidly pushing untested patches into production risks breaking business-critical services.
- Misallocated Resources: Time spent patching an isolated, authenticated background system is time not spent securing critical edge infrastructure.
CVSS scores alone no longer offer enough context. A CVSS 9.8 vulnerability on an isolated subnet behind three layers of strict network access control requires a completely different urgency than a CVSS 7.5 vulnerability exposed to the public internet.
Anatomy of the Threat: The Remote, Unauthenticated, Zero-Click Profile
To prioritise effectively, security leaders must look through the eyes of modern attackers. Threat actors favour the path of least resistance that yields maximum access with minimal noise.
The most dangerous vulnerability profile in today’s threat landscape combines three specific traits:
- Remote: The vulnerable asset is reachable over the network or public internet.
- Unauthenticated: An attacker does not need valid credentials, active sessions, or insider access to execute code.
- Zero-Click: The exploit triggers automatically as soon as data or a network packet is parsed, requiring no user interaction, link clicking, or file opening.
When these three elements intersect on an internet-exposed system, threat actors can automate exploitation at machine speed. This is the precise attack vector where “days of exposure” matter most.
Defining Your Acceptable Days of Exposure
Instead of asking, “How fast can we patch everything?” security leaders should ask, “How many days of exposure are we willing to accept on our highest-risk assets?”
Establishing a risk-managed patching framework requires categorising systems based on accessibility and business impact, then defining explicit exposure tolerances for each layer:
| Asset Tier | Risk Profile | Example Systems | Exposure Tolerance | Action Required
|
|---|---|---|---|---|
| Tier 1: Exposed Critical | Public-facing, Remote, Unauthenticated, Zero-Click risk | VPN gateways, edge firewalls, web applications, mail servers | 24–48 Hours | Immediate patching, virtual patching, or WAF/network isolation |
| Tier 2: Protected Critical | High-value business systems behind authenticated boundaries | Databases, Active Directory, internal application servers | 7–14 Days | Standard emergency patch windows with staging tests |
| Tier 3: Low Exposure | Isolated, internal-only, low-privilege systems | Development environments, offline endpoints | 30+ Days | Scheduled monthly/quarterly maintenance cycles |
Practical Questions for Security Leaders
To shift from a reactive patch-cycle treadmill to an environment-specific risk management strategy, security leadership should evaluate the following questions:
- Reachability & Attack Surface: Which of our public-facing assets ingest untrusted data without prior authentication?
- Mitigating Controls: If a patch cannot be applied within our exposure window, do we have network segmentation, web application firewalls (WAFs), or virtual patching in place to reduce exposure immediately?
- Blast Radius: If a zero-click vulnerability compromises a given system, can the attacker move laterally, or is the blast radius strictly contained?
- Tool Alignment: Does our vulnerability management scanner evaluate real-world exploitability (e.g., EPSS scores, active exploitation data) alongside environmental context, or is it just generating raw CVSS lists?
Winning the Race by Changing the Game
AI-driven vulnerability detection has permanently altered the tempo of cybersecurity. Trying to patch every flaw at maximum speed is a strategy with diminishing returns.
By identifying edge systems exposed to remote, unauthenticated, zero-click attack profiles, establishing realistic risk budgets, and applying compensating controls where patches aren’t immediately feasible, security teams can effectively neutralise the AI threat advantage. Focus less on total patch velocity, and focus more on reducing exposure windows where it actually counts.
Find out more by talking to our team today.
