Notifications
Clear all
Topic starter
22/07/2026 4:37 pm
TL;DR: Mandiant’s M-Trends 2026 reports the average vulnerability is exploited seven days before a fix exists, while CrowdStrike’s 2026 Global Threat Report says 42% of exploited vulnerabilities were attacked before public disclosure. Illumio argues the useful control is containment, not patch velocity, because disclosure now doubles as attacker reconnaissance.
NHIMG editorial — based on content published by Illumio: The Vulnerability Disclosure Paradox: Why Faster Patching Can’t Outrun AI-Generated Attacks
By the numbers:
- Mandiant’s M-Trends 2026 Report shows that the average vulnerability now gets exploited seven days before a fix even exists.
- CrowdStrike’s 2026 Global Threat Report found that 42% of exploited vulnerabilities were attacked before they were publicly disclosed.
- The first half of 2026 produced more than 35,000 CVEs, up nearly 50% over the same period last year.
Questions worth separating out
Q: How should security teams handle critical vulnerabilities when patching cannot happen right away?
A: Teams should treat the vulnerability as a live production exposure and decide whether a runtime compensating control can contain exploitation until patching is possible.
Q: Why do disclosed vulnerabilities create a bigger risk in AI-driven attack environments?
A: AI reduces the effort required to compare patched and unpatched code, generate exploit candidates, and iterate quickly.
Q: What breaks when segmentation is not in place during active vulnerability exploitation?
A: Without segmentation, a single reachable weakness can become an environment-wide problem because attackers can move laterally from the first compromised system into adjacent assets.
Practitioner guidance
- Reduce reachability to critical systems now Identify the assets whose compromise would create the largest blast radius, then restrict network paths, service access, and privileged routes to only the identities that genuinely need them.
- Tie vulnerability triage to access scope When a new CVE appears, classify not just the exploitability of the flaw but which users, workloads, and admin paths can actually reach the vulnerable component.
- Shorten emergency containment workflows Pre-approve temporary segmentation changes, privileged access restrictions, and emergency routing changes so teams can act before a disclosure becomes a working exploit.
What's in the full article
Illumio's full blog covers the operational detail this post intentionally leaves for the source:
- Raghu Nandakumara and Jason Garbis’ full discussion of how AI shortens the disclosure-to-exploit window.
- The specific example of reducing exposure from 5,000 reachable users and devices to roughly 200 finance users.
- CISA’s Binding Operational Directive 26-04 context and why publicly exposed, actively exploited vulnerabilities now have a three-day remediation target.
- The article’s practical segmentation guidance for critical assets and legacy systems.
👉 Read Illumio's analysis of AI-generated exploits and breach containment →
AI-generated exploits and segmentation: are your controls ready?
Explore further
22/07/2026 4:42 pm
Patch velocity is no longer the primary defensive variable. The article shows that exploit timelines have become shorter than many change-management cycles, so the old race-to-patch model is structurally behind. In practice, the decisive question is whether reachability is constrained when disclosure happens. Teams that still measure success only by mean time to patch are optimising the wrong control.
A question worth separating out:
Q: Which frameworks should teams use to govern reachability and exploit containment?
A: NIST Cybersecurity Framework 2.0 and MITRE ATT&CK are the most useful starting points because they connect exposure reduction, detection, and attacker behaviour. IAM and PAM teams should also align access scope to zero trust and least privilege so containment decisions reflect who and what can actually reach vulnerable services.
👉 Read our full editorial: AI-generated exploits are outpacing patch cycles and containment
