Notifications
Clear all
Topic starter
09/07/2026 10:03 am
TL;DR: AI-driven vulnerability discovery is compressing the window between discovery and weaponization to hours, while security programmes built on weekly patch cycles and quarterly testing were not designed for that pace, according to the Cloud Security Alliance briefing published by Knostic. Minimum viable resilience, automated assessment, and faster governance become the practical response, not optional hardening.
NHIMG editorial — based on content published by Knostic: "The AI Vulnerability Storm" briefing on building a Mythos-ready security program
Questions worth separating out
Q: What breaks when vulnerability discovery is faster than patch cycles?
A: Patch-centric programmes break because they assume security teams have days or weeks to assess, approve, and deploy fixes.
Q: Why do AI-driven exploits matter for identity and access governance?
A: Because once a flaw is weaponised, the next step is often credential use, privilege escalation, or service account abuse.
Q: How do security teams know whether their vulnerability programme is keeping up?
A: Look for measurable reductions in time from disclosure to validated remediation, fewer exceptions on internet-facing assets, and faster containment when active exploitation appears.
Practitioner guidance
- Rebuild patch prioritisation around exploitability windows Classify vulnerabilities by time to likely weaponization, not only severity score.
- Harden the basic controls that slow AI-assisted attackers Strengthen segmentation, egress filtering, and multifactor authentication on all systems that can reach sensitive data or administrative interfaces.
- Build a continuous VulnOps workflow Treat vulnerability intake, exception approval, remediation, and verification as one governed process with named owners and auditability.
What's in the full report
Knostic's full briefing covers the operational detail this post intentionally leaves for the source:
- Prioritised action plan with start dates and time horizons for a Mythos-ready security programme
- Board-facing language for explaining shorter adversary timelines and remediation pressure
- Operational recommendations on automated security assessments and LLM-powered vulnerability finding
- Governance changes needed for faster vendor onboarding and AI-based defence deployment
👉 Read Knostic's analysis of the AI vulnerability storm and Mythos-ready security →
AI vulnerability discovery is outpacing patch cycles: are controls keeping up?
Explore further
09/07/2026 10:04 am
AI-driven exploit velocity creates a defender timeline problem, not just a vulnerability problem. The central failure is no longer whether organisations can find flaws, but whether they can respond before attacker automation closes the window. That changes programme design from patch-centric to time-centric, with prioritisation, validation, and rollback measured against exploitability. For practitioners, the lesson is to govern response speed as a control objective, not an operational hope.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when AI-enabled exploitation outruns remediation?
A: Accountability sits with the security, infrastructure, and application owners who control prioritisation, patch deployment, and access governance. Boards should expect clear escalation criteria, while operational leaders should own the evidence that emergency changes, privilege changes, and verification steps are actually working.
👉 Read our full editorial: AI vulnerability discovery is outpacing defender patch cycles
