• As frontier AI accelerates both vulnerability discovery and exploit development, security leaders must assume threats will move faster than patching processes can keep pace.
• Vulnerabilities are only a small part of the risk. The risk spans three fronts: the risk from your own organization, the risk of increased attack surface, and the risk from attackers now armed with AI.
• Improved patching is not sufficient and defenders must strengthen resilience today through layered controls, unified visibility, AI-assisted detection and response, and faster mitigation and recovery practices.

Every board and every vendor is now repeating the same mantra: AI lets attackers discover and weaponize vulnerabilities in minutes and at an overwhelming scale, so we have to patch faster. They're right that the old timeline is dead, but wrong about the fix. You can't win a footrace against a machine, and more importantly, vulnerabilities were never the whole problem.

AI has opened three fronts of risk at once. From the inside-out, your own people and systems adopt AI in the shadows, leak data into it, over-trust what it returns, and hand agents the keys. From the outside-in, the AI infrastructure you're deploying becomes a new attack surface, a goldmine of data that attackers can leverage, plunder, and poison. And finally, attackers are now wielding AI models designed to find weaknesses, build attacks, and automate the entire attack chain at machine speed. Patching addresses, at best, a humble sliver of one of these fronts.

So stop all the hand-wringing over optimizing the patching clock because that isn’t the key to winning this. The metric that matters isn't mean time to patch (MTTP), but mean time to mitigate (MTTM), or how fast you make a threat irrelevant, whether or not anything ever gets patched. Patching eliminates a flaw, whereas mitigation severs the path to exploiting it. Patching has become an unwinnable race against machines while mitigation can be won with vulnerability-agnostic compensating controls that are effective no matter which CVE drops tomorrow, which new frontier AI model shipped last night, or which tool an attacker just picked up.

AI risk has three fronts

Before we can lower MTTM, we must recognize what actually needs mitigating. AI risk isn’t just a faster version of the old vulnerability problem. It's three distinct fronts: risk from the inside-out, risk the outside-in, and risk from an accelerant that makes the first two worse. Patching, at best, nicks the edge of one of them.

1. The inside-out front: The call is coming from inside the house

The first front has nothing to do with attackers. It comes from your own people and systems doing exactly what they've been told to do—use AI.

It starts when employees adopt AI faster than you can govern it, such as personal chatbot accounts or an "AI toggle" quietly flipped on inside a SaaS tool you already approved. Even if a tool is sanctioned, employees accidentally leak sensitive material into these tools to get work done. Source code, customer records, and financials flow out where they may be retained, cached, or used to train someone else's model. 

Then employees trust what comes back, pulling AI-generated artifacts straight into the environment. These might be vulnerable code, financial forecast figures the model invented, a legal brief citing cases that don’t exist, or a support representative confidently relaying a wrong answer to a customer. 

And finally, employees delegate, handing agents broad, standing permission to act, thus allowing agents to take cascading, non-deterministic actions, inadvertently wiping your database, or running up a fortune in cloud spend.

Underneath all this, the human checkpoint is eroding. The review step that once caught the mistake before it occurs is being automated away, replaced by a reflexive trust in whatever the AI returns. None of this is a vulnerability you can patch.

2. The outside-in front: Your AI is the attack surface

The second front is the mirror image. Every model, agent, and integration you stand up is new infrastructure, and new infrastructure creates a new attack surface. To an attacker, your AI stack offers three enticing opportunities.

Leverage. Whether by injecting hidden instructions (prompt-injection) or hijacking an exposed inference endpoint, attackers make your AI work for them, leaking data, reaching systems they could never touch directly, or running their own workloads on your bill.

Plunder. Your AI stack is a goldmine of sensitive data and much of it now sits in places nobody thought to secure. AI tools have quietly scattered sensitive data across the environment. Coding assistants cache entire repositories, prompts, and history in hidden working directories full of source code, secrets, and internal context that never used to live on an endpoint. Desktop AI apps do the same with confidential documents and financial figures. Credentials and tokens are cached in these same systems and also get written into plaintext config so agents and MCP servers keep running. Vector stores hold embedded copies of files that were once locked behind access controls and custom models can be coaxed into giving up their training data. So now a single compromised laptop or misconfigured store yields far more than it did before AI.

Poison. The components themselves can arrive (or become) trojanized, such as a backdoored open-weight model pulled from a public repository, a trojanized harness, a poisoned fine-tuned dataset, or tampered content sitting in a vector store the model trusts as ground truth. All of these result in a model that behaves normally right up until the attacker's trigger arrives.

And none of this is a vulnerability you can patch, but is an attack surface that expands every time you deploy something new.

3. The attacker front: The accelerant

Attackers aren’t sleeping on AI, and they are pointing it at the entire attack chain to find a way in. This is where the vulnerability problem everyone is worried about actually lives, and the hype is not just marketing. The mean time to exploitation (MTTE) of a new vulnerability is shrinking at a pace that nearly defies belief: last year it reached one week, this year it will reach one day, and next year it will reach one minute. (Because that metric measures the mean, half of all exploits will happen in less than a minute.) Meanwhile, IT teams still need days or weeks to test and deploy a critical patch. Attackers will exploit a flaw faster than most approval committees can schedule the meeting to discuss it.

And that assumes a patch even exists. Current AI models aren’t just able to weaponize disclosed vulnerabilities or reverse-engineer patches, but they can discover zero-day vulnerabilities in binaries outright, with no patch to work from. Zero days now make up the majority of exploited vulnerabilities, representing 82% of all exploited vulnerabilities (up from 53.6% in 2025), which means security teams face more and more vulnerabilities for which no patch is available. Frontier AI models can already discover previously undetected vulnerabilities at a pace no human or scanner can match, and worse, chain together individually low-risk gaps into a viable attack path that does real damage.

Vulnerabilities aren’t the only way in. Attackers are using AI to perform continuous reconnaissance across your entire footprint, mapping exposed assets, enumerating services, and sifting public data for the details that make an intrusion easier. They surface the weaknesses that were never CVEs at all, such as misconfigurations, forgotten internet-facing systems, default or reused credentials, and over-permissioned identities. AI-driven "malicious pen-testing" probes your live environment for an exploitable path the way a red team would, only faster and around the clock. They also profile your people, building the target lists and pretexts for the social engineering that so often opens the door in the first place.

Aside from using AI to find their way in, attackers are also using it to build what comes next.  What used to take a skilled attacker days now takes a prompt to produce working exploits, custom malware, and perfect social engineering emails.

Finally, with agentic AI, they can automate the entire attack chain. Agents stitch the stages together with little human input, from reconnaissance to social engineering to exploitation to exfiltration. Because all of this runs at machine speed, every organization is now worth attacking.

When vulnerabilities are inevitable, Mean Time to Mitigate is what matters

None of this means patching doesn’t matter. Patching is still worth doing, but patching was only ever an answer to a small segment of the risk, and even there, speed can’t save you when patches aren’t available or attackers move faster than your change-approval process. Further, you cannot patch an employee who pastes source code or classified information into a chatbot, a model that was poisoned before you deployed it, or an agent that wipes your database.

So the real question is not only how to patch faster, but what to do given that exploitation will happen regardless of a vulnerability or patch. The answer is to stop measuring success by how quickly you eliminate vulnerabilities, and start measuring it by how quickly you make them irrelevant. That brings us back to Mean Time to Mitigate (MTTM), and you achieve it with compensating controls: vulnerability-agnostic defenses that eliminate attack surfaces, block an attacker’s behavior, and limit the damage no matter which door the attacker comes through.

Here’s what security practitioners can do right now to implement compensating controls and improve their defenses against what’s coming.

1. Discover and govern AI use. You can't protect what you can't see, and shadow AI is already in your environment: personal chatbot accounts, unsanctioned tools, and AI features quietly switched on inside SaaS platforms you've already approved. For organizations that rely at least in part on cloud-based platforms, solutions like Cloud Access Security Broker (CASB) surface that usage, steer people toward sanctioned tools, and let you enforce acceptable-use policy. 
2. Stop sensitive data from walking out the door. Attackers are generally after two things: data or disruption (though sometimes both). Without the right protections, internal use of AI platforms can expose sensitive data, often inadvertently and with zero effort from attackers. Add attacker-driven data discovery and theft, and data loss prevention (DLP) protections become that much more critical.
3. Harden at the edge. Ensure appropriate firewalling, IDP, authentication, and malware detection controls are all in place and fully operational. Don’t neglect the software you expose to public networks. On-premise or cloud-based endpoint protection allows you to shield these popular points of infiltration. 
4. Block bad behavior before it does damage. IT may be focused on patching, but security focuses on preventing exploits and attacks. That job becomes far easier if you can stop attacks before they begin. Behavioral blocking automatically stops potentially suspicious activity, including anomalous use of legitimate software—ground zero for living off the land (LOTL) attacks. Also: Consider deploying application control protections that deny access and executables by default, allowing them to enter or run only after proving they’re trustworthy. Both protections carry the added benefit of shrinking your attack surface.
5. Unify your visibility to stop unpatched lateral movement. Let’s face it, with exploits happening before patches are available and deployed, something’s bound to get through. That’s why it’s vital to understand what’s happening throughout your environment so you can stop attackers before they get what they came for. AI-enabled cross-vector visibility is a must here, and so is the ability to correlate telemetry from endpoints, networks, SaaS applications, and data to surface real understanding about what’s happening before it gets out of hand. This ensures that if one unpatched system is probed, machine-speed AI contains the incident immediately. 
6. Deploy AI protections to anticipate, investigate, and remediate attacks. Believe it or not, you can deploy AI-powered tools today that leverage a massive database of real-world threat intel to actually predict an attacker’s next four or five moves and shut down their path before they can progress. Add the ability to visually and dynamically investigate an attack, and produce investigation summaries that connect the dots for analysts at all levels, provide MITRE mappings, and even offer a path to remediation. Because when attacks happen at this velocity, every second matters.  
7. Do all you can to mitigate faster. Threat actors are moving at machine speed, and mitigation needs to operate just as quickly. Consider platform solutions like XDR that pull together the entire picture and give you all the tools and intelligence you need to mitigate quickly while shutting down avenues for future attacks. 
8. Run only supported software. Unsupported versions of software expose environments to exploit and compromise regulatory compliance. Coordinate with IT to ensure users and systems run only supported software. (This goes for AI tools as well, which, even if they’re not jailbroken by threat actors, can still expose sensitive data if you don’t have the right controls in place.) 
9. Reassess configurations. Configuration errors or gaps leave you exposed. Work with IT to ensure software is not just up to date but also configured to support security controls. Some systems, including email, almost always benefit from a configuration review.
10. Confirm you’re set with comprehensive logging and monitoring. Operational telemetry is critical in post-incident response and for detection and containment. Once again, the ability to gather and correlate telemetry across all domains puts you a step ahead here.
11. Prepare to recover quickly. The sober reality for security practitioners is that, despite all the compensating controls you put in place, it’s possible you could be seeing more breaches than before. Everything you can do to shorten your recovery point and recovery time objectives will help your organization weather the storms that are coming. 

Bottom line: Assume the vulnerability, deny the attacker

You cannot patch your way out of AI. The exploitation window has collapsed, two of the three fronts have no patch at all, and attackers will now move at machine speed across every one of them. That is not cause for despair, but it’s a reason to change what you focus on and invest in.

Stop grading security only on how fast you close flaws, and start grading it on how fast you make them irrelevant. Every control above is vulnerability-agnostic. It does not care which CVE dropped this morning, which AI feature shipped last night, or which tool the attacker just picked up. That is what drives down Mean Time to Mitigate, and MTTM, not patch speed, is what decides whether an inevitable exploit becomes a contained event or a business-halting breach.

Acceptance is the first step. Action is the second. The organizations that come through the AI era intact will not be the ones that patched the fastest. They will be the ones that made the vulnerability irrelevant.

In an age of endless Zero Days and accelerating threats, defenders need all the advantages they can get. 

Explore how you can deploy the latest breakthroughs in AI-driven protections in the eBook, 8 Ways AI is Easing Stress on the SOC.