Topic starter
18/08/2026 2:31 pm
TL;DR: AI models are compressing the time between disclosure and exploitation, with Rapid7 finding the median gap to CISA’s KEV catalog fell from 8.5 days to 5 days in one year, according to FOSSA. That shift makes dependency freshness and remediation throughput a governance problem, not just an engineering backlog.
Editorial analysis by NHI Mgmt Group, based on content published by FOSSA: “Project Glasswing and Vulnerability Exploitation Velocity”.
Key questions
Q: What breaks when vulnerable dependencies stay outdated in AI-accelerated environments?
A: Patch windows collapse faster than most teams can respond, so outdated dependencies stop being a background hygiene issue and become an active exposure state.
Q: Why do known CVEs in common packages attract more attacker effort than zero-days?
A: Known CVEs offer the best effort-to-reward ratio.
Q: How do teams know whether dependency remediation is actually keeping up?
A: Look at time to remediation, version lag, and the proportion of findings that move from alert to deployed fix without manual backlog growth.
Practitioner guidance
- Shorten dependency remediation SLAs Set explicit time-to-remediate targets for critical libraries based on exploitability, not only severity scores.
- Automate upgrade completion, not just detection Use tooling that can research breaking changes, update code, and open completed pull requests so dependency findings do not stall in triage queues.
- Prioritise packages with known public exploit paths Rank remediation queues by whether the vulnerability is already documented, weaponised, or present in common dependency chains.
Bottom line: AI-assisted exploitation is shrinking the defender’s usable patch window, which turns remediation speed into a primary security control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:18 pm
Exploit velocity has become a governance variable, not just a threat trend. Once AI shortens the interval between disclosure and exploitation, the effectiveness of patching is determined less by whether a vulnerability is known and more by whether an organisation can complete remediation before the attack window closes. That shifts attention from vulnerability counts to operational throughput. Practitioners should manage remediation as a time-bound control objective, not an open-ended backlog.
A few things that frame the scale:
- Vulnerability exploitation accounts for 32% of initial infections in Mandiant’s 2026 M-Trends report.
A question worth separating out:
Q: How should organisations balance faster automation with change assurance in dependency updates?
A: By separating decision speed from deployment trust. AI can accelerate research, code changes, and pull request creation, but merge and release rights should still be tightly governed, especially in CI/CD. The right model is fast remediation with minimum necessary access, test gates, and traceable approval for production-impacting changes.
👉 Read our full editorial: AI-driven exploit speed is shrinking defenders’ patch windows