Topic starter
21/10/2026 2:46 pm
TL;DR: Exploit timing is tightening fast: Mandiant's MTTE trend fell from 63 days in 2018 and 2019 to an estimated -7 days in 2026, according to Asimily. OT and IoMT programs need containment and segmentation to reduce exposure while fixes are still pending.
Editorial analysis by NHI Mgmt Group, based on content published by Asimily: “How AI Is Compressing the Time Between Vulnerability and Exploit”.
By the numbers:
- Mandiant's tracked average MTTE fell from 63 days in 2018 and 2019 to 44 days by early 2021, 32 days in 2022, and 5 days in 2023.
Key questions
Q: Why do OT and medical devices face higher risk from shrinking exploit windows?
A: They depend on manufacturer validation, maintenance windows, and operational approvals that delay patching.
Q: What are the signs that containment controls are failing in a modern environment?
A: The warning signs are broad lateral movement paths, shared admin accounts, persistent service credentials, and critical systems that sit close to routine user or developer environments.
Q: What breaks when patching OT and IoMT devices cannot keep pace with exploitation?
A: The assumption that remediation will arrive before attackers operationalise the flaw breaks down.
Practitioner guidance
- Constrain device communications to known peers Define the minimum network paths each OT, IoT, and IoMT device actually needs, then block all other traffic by default.
- Prioritise containment for unpatchable assets Build a separate response path for legacy controllers and medical devices that cannot be updated quickly.
- Validate exploitability before enforcement Test policies against observed traffic so operational teams can see which communications would be blocked before the change goes live.
Bottom line: AI-assisted exploitation is shrinking the time defenders have to react, which undermines the old assumption that patching will usually arrive first.
Glossary terms: Time-to-Exploit, Blast Radius, Operational Technology, Microsegmentation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
21/10/2026 7:00 pm
Exploitability has become an operational state, not a post-disclosure phase. When exploitation starts before patch release, the old assumption that defenders can always race to remediation no longer holds. The governance issue is not simply patch speed but whether the environment can absorb exposure safely while waiting for a fix. For OT, IoT, and IoMT programmes, that means containment is now part of vulnerability management, not a separate network discussion.
A question worth separating out:
Q: Should teams prioritise microsegmentation or patching first during an active vulnerability campaign?
A: Teams should patch or isolate the most exposed systems first, then use microsegmentation to limit what remains reachable during the remediation window. Segmentation does not fix a vulnerable service, but it can prevent one compromised host from becoming a route to broader ransomware impact. The right sequence depends on exposure, but both controls are needed to shrink blast radius.
👉 Read our full editorial: AI is shrinking exploit windows for OT and IoMT devices
This post was modified 4 days ago by NHI Mgmt Group