Topic starter
24/07/2026 4:08 pm
TL;DR: AI has collapsed the median time from disclosure to exploitation from about 10 months in 2021 to three hours in 2026, while frontier models are making multi-step attack chains easier to automate, according to Illumio and the U.K. AI Security Institute. The security problem is no longer just patch speed, but how far an attacker can move after the first foothold.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “The Race to Stop AI From Turning Vulnerabilities Into Breaches”.
By the numbers:
- AI has collapsed the median time from vulnerability disclosure to exploitation from about 10 months in 2021 to three hours in 2026.
Key questions
Q: What breaks when vulnerability response windows shrink to hours?
A: Patch-first operating models break when the attacker can exploit a flaw before validation, change control, and deployment finish.
Q: Why do AI-driven vulnerability discoveries increase blast-radius risk?
A: They shorten the time between flaw discovery and weaponization, which reduces the window defenders have to patch or tune detections.
Q: How do security teams know whether containment is actually working?
A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded.
Practitioner guidance
- Shorten exposure-to-containment decisions Map your highest-risk services to the controls that must activate before a newly disclosed flaw can be exploited, including emergency isolation and reachability reduction.
- Reduce standing reach across critical systems Review which systems can be reached from an initial foothold and remove unnecessary network and identity paths that would let a compromise spread.
- Prioritise blast-radius metrics over patch queue metrics Track how much access an exploited host can obtain, how quickly it can be quarantined, and which privileges remain valid during the response window.
Bottom line: AI-speed exploitation compresses the time available to react, which makes exposure reduction and containment more important than ever.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:12 pm
AI-speed exploitation is really a containment governance failure. Once disclosure-to-exploitation falls to hours, the old assumption that patching will outrun abuse stops holding. Security programmes must treat post-exploit movement as the primary risk variable, not a secondary consequence. The practitioner conclusion is clear: resilience now depends on what remains reachable after the first compromise.
A question worth separating out:
Q: What should organisations do first when AI-driven attacks speed up exploitation?
A: Organisations should focus first on identities that already combine privilege, persistence, and secret access. Those are the fastest paths to compromise and the hardest to detect manually. The first 24 to 72 hours should be spent reducing exposure windows, validating revocation, and confirming which agents or service accounts can still reach sensitive systems.
👉 Read our full editorial: AI-speed exploitation is collapsing vulnerability response windows