Notifications
Clear all
Topic starter
02/08/2026 12:24 pm
TL;DR: Google Threat Intelligence Group says the median time to exploit vulnerabilities reached -1 days in 2024, meaning attackers are often weaponizing flaws before public disclosure or patch release, while defenders still work on weekly or daily cycles. The operational gap now demands automated detection, rapid validation, and tighter response workflows rather than slower manual tuning.
NHIMG editorial — based on content published by Impart: In the AI Era, Security Teams Must Respond at AI Speed
By the numbers:
- The median time to exploit vulnerabilities dropped to -1 days in 2024.
- From 2018 to 2019, security teams had an average of 63 days to respond.
- By 2023, that response window had fallen to just 5 days.
Questions worth separating out
Q: What breaks when exploit timelines turn negative?
A: Patch-first response models break when attackers exploit vulnerabilities before public disclosure or vendor remediation.
Q: Why do fast exploit cycles matter for IAM and NHI programmes?
A: Fast exploit cycles matter because access paths, tokens, service accounts, and delegated privileges can be abused as soon as a weakness is reachable.
Q: How do teams know if their detection pipeline is actually working?
A: Look for three signals: scheduled detections are executing on time, enriched events retain identity and asset context, and downstream search results are consistent across tools.
Practitioner guidance
- Reset remediation expectations around exploitation speed Replace calendar-based response targets with exposure-based priorities that account for disclosure lag, exploit automation, and the probability of pre-patch weaponisation.
- Automate detection deployment and rollback Build a pipeline that can test, version, approve, and roll back detection logic quickly enough to keep pace with changing exploit patterns.
- Correlate vulnerability response with identity exposure When a weakness is identified, immediately check whether exposed secrets, service accounts, delegated access, or privileged tokens create a faster path to impact.
What's in the full article
Impart's full post covers the operational detail this analysis intentionally leaves for the source:
- Google Threat Intelligence Group data behind the negative time-to-exploit trend and the exact year-on-year breakdown.
- The article's discussion of how security teams are compressing threat investigation, incident response, and vulnerability workflows into hours.
- Practical commentary on AI-assisted detection engineering, including why rule tuning and validation become bottlenecks.
- The vendor's perspective on building faster defensive workflows around production traffic and behavioural analysis.
👉 Read Impart's analysis of why security teams must respond at AI speed →
AI-speed response and the governance gap teams are missing?
Explore further
02/08/2026 1:23 pm
Speed is now a governance variable, not just an operational metric. When median exploit time turns negative, remediation SLAs stop being the main issue because the attack often begins before the formal response process starts. That changes how programmes should think about exposure management, especially where privileged access or secrets are involved. The implication for practitioners is that response design must be measured against attacker velocity, not internal ticketing cadence.
A question worth separating out:
Q: Which frameworks best support rapid response to exploit acceleration?
A: NIST CSF and NIST SP 800-53 are the clearest anchors for response orchestration, monitoring, and control validation, while IAM and NHI programmes should pair them with access-centric governance. If the article’s speed problem also affects identity paths, teams should use the 52 NHI breaches analysis to understand how exposed credentials amplify exploitation speed.
👉 Read our full editorial: Security teams now need AI-speed response as exploit windows collapse
