Exploit windows are collapsing for OT and IoMT teams: are controls ready?

TL;DR: Asimily says AI is compressing the time between vulnerability disclosure and first exploitation, with Mandiant's MTTE trend falling from 63 days in 2018 and 2019 to an estimated -7 days in 2026. That makes patching alone insufficient for OT and IoMT environments, where segmentation and containment now have to carry more of the risk burden.

Editorial analysis by NHI Mgmt Group, based on content published by Asimily: “How AI Is Compressing the Time Between Vulnerability and Exploit”.

By the numbers:

• Mandiant's tracked average MTTE fell from 63 days in 2018 and 2019 to 44 days by early 2021, 32 days in 2022, and 5 days in 2023.

Key questions

Q: What breaks when patching OT and IoMT devices cannot keep pace with exploitation?

A: The assumption that remediation will arrive before attackers operationalise the flaw breaks down.

Q: Why do OT and medical devices face higher risk from shrinking exploit windows?

A: They depend on manufacturer validation, maintenance windows, and operational approvals that delay patching.

Q: What are the signs that containment controls are failing in a modern environment?

A: The warning signs are broad lateral movement paths, shared admin accounts, persistent service credentials, and critical systems that sit close to routine user or developer environments.

Practitioner guidance

• Constrain device communications to known peers Define the minimum network paths each OT, IoT, and IoMT device actually needs, then block all other traffic by default.
• Prioritise containment for unpatchable assets Build a separate response path for legacy controllers and medical devices that cannot be updated quickly.
• Validate exploitability before enforcement Test policies against observed traffic so operational teams can see which communications would be blocked before the change goes live.

Bottom line: AI-assisted exploitation is shrinking the time defenders have to react, which undermines the old assumption that patching will usually arrive first.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →