Topic starter
22/07/2026 4:37 pm
TL;DR: Mandiant’s M-Trends 2026 reports the average vulnerability is exploited seven days before a fix exists, while CrowdStrike’s 2026 Global Threat Report says 42% of exploited vulnerabilities were attacked before public disclosure. Illumio argues the useful control is containment, not patch velocity, because disclosure now doubles as attacker reconnaissance.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “The Vulnerability Disclosure Paradox: Why Faster Patching Can’t Outrun AI-Generated Attacks”.
By the numbers:
- 42% of exploited vulnerabilities were attacked before they were publicly disclosed.
Key questions
Q: What fails when organisations rely on patching speed alone after disclosure?
A: Patching speed fails when exploit generation is faster than validation, deployment, and rollback.
Q: Why do publicly exposed vulnerabilities create such a short decision window for defenders?
A: Once a vulnerability is disclosed and remains unpatched, attackers can begin working immediately while defenders are still validating scope and impact.
Q: How do security teams know if segmentation is actually reducing risk?
A: Teams know segmentation is working when unnecessary workload communications disappear, exception volume falls, and policy changes are validated continuously rather than assumed.
Practitioner guidance
- Prioritise segmentation around high-value systems Start with the applications and data stores whose compromise would create the largest business impact, then restrict reachability to the smallest viable identity set.
- Build an accurate workload and identity inventory Map which users, devices, workloads, and service identities actually need access before translating policy into network or host enforcement.
- Treat disclosure as a containment trigger When a vulnerability becomes public, immediately review whether the affected asset sits behind meaningful reachability limits or is exposed to the full environment.
Bottom line: The article’s central warning is that exploit creation now moves faster than patch validation in many real-world cases.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
22/07/2026 4:42 pm
Containment is now the primary control variable when exploit generation outpaces remediation. Patch velocity still matters, but it no longer defines whether an environment remains defensible during disclosure-driven exploitation. The security programme that survives this shift assumes compromise during the patch window and limits what that compromise can reach. Practitioners should treat blast-radius reduction as a first-class control objective.
A few things that frame the scale:
- The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: What should teams do when a critical flaw is disclosed before remediation is available?
A: Contain the reachable surface first. That means restricting access, isolating the affected service, and removing unnecessary administrative paths before the exploit window is closed with a patch. When a service is both exposed and high value, compensating controls are the only safe bridge between disclosure and full remediation.
👉 Read our full editorial: AI-generated exploits are outpacing patch cycles and containment
This post was modified 5 hours ago by NHI Mgmt Group