Topic starter
14/07/2026 4:24 pm
TL;DR: Frontier AI is shortening the time between vulnerability discovery and exploitation, leaving patching too slow to remain the primary clock of defense, according to Proofpoint. The practical shift is toward reducing exposure across people, suppliers, digital workflows, and AI agents while attack speed outpaces remediation.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “The Patch Cycle Is No Longer the Security Clock”.
Key questions
Q: How should security teams reduce the impact of zero-day vulnerabilities in running workloads?
A: Security teams should assume that patching alone will not close the gap fast enough and place runtime controls around running workloads.
Q: Why do AI-driven attacks increase risk for identity and access management programmes?
A: They increase risk because they compress the time between exposure and impact.
Q: What are the signs that protection is lagging behind the attacker’s pace?
A: The clearest signs are long gaps between threat discovery and policy change, repeated compromise through the same trust paths, and supplier or workflow exposures that remain reachable after alerts are raised.
Practitioner guidance
- Define exposure as a board-level metric Track how long a newly weaponised issue remains reachable in user, supplier, and workflow paths before controls change the outcome.
- Map identity attack paths across human and non-human accounts Review where phishing, credential theft, delegated access, and service identities intersect so you can shorten the attacker’s usable window.
- Test whether protection propagates faster than exploitation Measure how quickly new detections, blocks, or policy updates reach the whole environment after first sighting of a novel threat.
Bottom line: Frontier AI is compressing the interval between flaw discovery and weaponisation, so patch cycles alone no longer define effective defence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:07 pm
Exposure reduction is becoming the primary security variable. When attackers can move from discovery to exploitation in hours, patching remains necessary but cannot be the only clock that governs defence. The control question changes from whether a flaw exists to whether the organisation can make the flaw unusable before it is operationalised. That is a material shift for all identity-adjacent attack paths, including email, collaboration, and automated workflows. Practitioners should treat exposure as the governing metric.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations govern supplier access when attack speed is increasing?
A: They should treat supplier and partner access as part of the live attack surface, not as a static onboarding issue. Governance should require inventory, scope review, and fast revocation paths for third-party credentials, because compromise in those paths can spread before normal remediation cycles finish.
👉 Read our full editorial: Frontier AI is compressing the zero-day defense window