Matthew Rosenquist explains how AI is compressing the time from vulnerability discovery to active exploit down to 4 to 24 hours, while most organizations patch on a 43-day cycle. Even top security teams remediate only 30-40% of threats in the first week. Traditional patching won't work anymore; teams need breach-and-attack simulation to prioritize the highest-risk assets.
Chapters
Matthew, Patch Tuesday is dead. Pika Security just reported that AI cuts vulnerability discovery to exploit down to 24 hours. Most companies have a patch cycle that takes around 43 days, and that's about to fail.
Yeah, so you look at 43 days it takes to patch, and yet the Hacker News articles says AI has now cut that time to exploit to 24 hours. 4 hours. So the attackers are getting well within that window of opportunity before a patch protects organizations.
Yeah, Verizon's data says that even top-performing security teams only close around 30 to 40% of known threats in the first week.
And that's just in a week. Now compound that. If you are missing a big chunk of being able to patch vulnerabilities in week 1, well, now compound that to week 2, week 3, week 4, it becomes a serious issue very fast.
It does. Pecos calls for breach and attack simulation to identify the highest risk areas.
Yeah, and this is really around prioritization, right? We have to think like an attacker. So BAS essentially is that simulation that acts like attackers to highlight the greatest risks so we know what to focus on.
Absolutely. There's links to the article from the Hacker News that addresses this below. Go to pikissecurity.com. That's pikissecurity.com to see the guide and get ahead of this.
