AI has compressed the gap between vulnerability discovery and exploitation from months to hours. In some cases, the clock now runs backwards: attackers are exploiting flaws before a patch even exists – a negative mean time to exploit.
That raises an uncomfortable question: If defenders have only hours to detect, triage and respond, is simply detecting faster already a losing strategy?
There is merit in that concern. But “pre-positioned containment” does not make detection obsolete. It means the security stack must be reoriented around AI-speed triage rather than human-speed correlation.
I have experienced this shift firsthand while working for a leading CRM vendor navigating its transition to an AI-powered platform. One lesson stands out: before making another tooling upgrade, CISOs should make three fundamental moves.
The Data Confirms the Shift
Verizon’s 2026 Data Breach Investigations Report found vulnerability exploitation now accounts for 31% of breaches, up from 20% the previous year, overtaking stolen credentials as the leading initial-access vector. Verizon links the increase directly to AI compressing the attacker’s timeline: turning an advisory into a working exploit no longer requires weeks of skilled manual work.
Rapid7’s 2026 Global Threat Landscape Report tells the same story differently. The median time between vulnerability publication and inclusion in CISA’s Known Exploited Vulnerabilities catalogue fell from 8.5 days to 5 days. Mandiant’s M-Trends 2026 goes further, estimating mean time to exploit at negative seven days – meaning exploitation can begin before a patch is available.
Regulators are responding too. In June 2026, CISA issued Binding Operational Directive 26-04, cutting the federal remediation deadline for critical KEV-listed vulnerabilities to three days. And markets are noticing as well: when Anthropic disclosed that its Claude Mythos model had identified thousands of zero-day vulnerabilities, Palo Alto Networks and CrowdStrike each dropped more than 5% in a single session.
The implication is clear: AI-accelerated offense could outrun AI-accelerated defense if defenders keep operating on human-speed assumptions.
Why the Old SOC Model Is Breaking
The traditional SOC assumed humans had enough time to investigate and act. AI has changed that equation. Three shifts are already reshaping the model:
- Reduce the noise before it reaches analysts. Modern platforms increasingly correlate endpoint, identity and cloud telemetry into coherent incidents rather than forcing humans to sift through thousands of alerts. CrowdStrike Falcon and Palo Alto Networks Cortex XSIAM illustrates this shift.
- Move triage and response to machine speed. Agentic SOC platforms can investigate alerts and return an escalate-or-dismiss recommendation, supported by an investigation report an analyst can audit. Automation can then turn confirmed decisions into containment within minutes.
- Prioritize exploitability, not just severity. CTEM platforms shift the question from “What has the highest CVSS score?” to “What is actually reachable and exploitable right now?”
These shifts help organizations react faster. But reacting faster is necessary, not sufficient. Based on more than two decades of experience working with some of the world’s largest companies, I believe there are three decisive moves CISOs should make now.
1. Reset Your Assumptions About the Attacker
The economics of exploitation have changed. Capabilities once concentrated among nation-state actors are becoming cheaper, faster and more widely accessible. AI can accelerate reconnaissance, vulnerability analysis, exploit development and attack iteration. Sophisticated capability no longer requires a sophisticated adversary.
Here are five practical moves to operationalize this shift:
- Revisit threat models for AI-speed exploitation. Assume attackers can move from disclosure to exploitation in hours, not weeks, and identify where existing response assumptions fail.
- Identify the systems you cannot afford to lose. Determine which assets would create the greatest operational, financial or customer impact if exploited before a patch exists.
- Predefine containment decisions. Agree in advance which systems can be isolated, restricted or temporarily disabled so teams are not negotiating authority during an attack.
- Prioritise by exploitability and business impact. Elevate issues that are exposed, reachable and capable of materially affecting the organization – not simply those with the highest score.
- Exercise decisions before the crisis. Run scenarios where teams must contain a fast-moving exploit with incomplete information and test whether escalation paths actually work.
The objective is simple: plan for the speed attackers can achieve now, not the speed they operated at three years ago.
2. Stop Remediating Vulnerabilities One CVE at a Time
The prevailing model still treats vulnerabilities as individual events: score the CVE, decide, patch, move on. That approach becomes unworkable when exploitation can begin within hours. A better model is to remediate by root cause and vulnerability category.
Group vulnerabilities that share the same library, protocol, weakness class, legacy component or architectural flaw, then address the underlying cause in one coordinated motion. Vendors are already moving this way. Cisco’s CVE-2026-20267 grouped related IOS XE flaws around common authentication, authorization and access-control weaknesses. Microsoft’s July 2026 Patch Tuesday likewise shifted away from purely CVE-by-CVE notes towards summaries organized by product family and weakness category.
To put category-level remediation into practice, CISOs should:
- Identify recurring sources of vulnerability. Group the backlog by shared libraries, protocols, legacy platforms and weakness classes to expose the conditions repeatedly generating new CVEs.
- Assign ownership for eliminating the root cause. Give a named technology or business owner responsibility for fixing the underlying weakness so every new CVE does not become a separate remediation exercise.
- Prioritize fixes that collapse multiple attack paths at once. Focus scarce engineering capacity on changes that remove clusters of exploitable vulnerabilities rather than patching findings one by one.
- Measure exposures retired, not just patches completed. Track how many vulnerabilities and attack paths disappear after each category-level remediation to demonstrate actual risk reduction.
The question changes from “How quickly can we patch this CVE?” to “What underlying condition keeps producing these vulnerabilities, and how do we remove it?” The outcome is fewer recurring vulnerabilities, less remediation churn and more risk removed for every unit of engineering effort.
3. Shrink the Attack Surface You Have to Defend
Another way to improve detection performance is to reduce the attack surface the security stack has to defend.
Consider a large online pharmacy chain. Its digital estate might include an e-commerce platform, mobile apps, customer portals, supplier interfaces, cloud workloads, APIs and years of accumulated legacy infrastructure. Buried inside could be an old supplier portal still exposed to the internet, a redundant VPN gateway, forgotten subdomains or an administrative interface never intended to remain public.
An AI-enabled attacker can discover and probe those assets at machine speed while the SOC is expected to monitor signals from every one of them. The answer cannot simply be more detection around unnecessary exposure. Retire the unused portal. Shut down the redundant gateway. Put administrative interfaces behind stronger controls. Decommission obsolete protocols and end-of-life systems.
For CISOs, that means:
- Establish an authoritative view of internet-facing assets. Find anything exposed without a clear owner, business purpose or current operational need.
- Retire unnecessary exposure aggressively. Decommission end-of-life systems, obsolete protocols, forgotten domains and redundant external services rather than surrounding them with more monitoring.
- Reduce public accessibility. Move administrative and sensitive services behind stronger identity, network and access controls wherever internet exposure is unnecessary.
- Create accountability and measure retirement. Give each exposed asset an owner and review date, and track assets, services and exploitable paths actually removed.
Reducing attack surface does not replace detection investment. It makes that investment work harder. For the pharmacy chain, every obsolete service removed means one less attack path, one less stream of telemetry and one less asset for AI and human defenders to evaluate.
Sometimes the fastest way to improve detection is to give it less to detect.
The Clock Has Changed. The Operating Model Must Change With It.
Detection can still win, but it increasingly needs to become AI-assisted, machine-speed and human-audited. That means redesigning the SOC analyst role around reviewing and challenging AI-generated triage, while defining which decisions AI can make autonomously, where human approval remains mandatory and how AI-generated conclusions will be validated.
The bigger message for CISOs is that this cannot become another tooling race. Reset the assumptions behind the threat model. Remediate systemic vulnerability classes instead of chasing individual CVEs. And relentlessly remove attack surface you no longer need.
AI has squeezed the vulnerability exploitation clock. Cyber defense now has to change with it.
