Skip to content
Indene
en

Artigos

The window between flaw and attack is shrinking, and monthly patching is no longer enough

Microsoft says AI gives attackers the edge and that an exploit for a flaw is ready in under 24 hours. Few flaws are exploited, but the ones that matter arrive before the monthly patch cycle.

By Rafael LimaCFO

4 min read

Curva de perda assimétrica em traço fino sobre fundo escuro esverdeado, com o pico marcado em verde, e o título The patch window is now measured in hours.
Curva de perda assimétrica em traço fino sobre fundo escuro esverdeado, com o pico marcado em verde, e o título The patch window is now measured in hours.

Microsoft's annual Digital Defense Report, published on October 1, 2026, says artificial intelligence has changed the economics of attack and defense, with the advantage going to attackers in the near term. The figure that matters most to whoever decides the budget is on another page: the median time from discovering a flaw being used in the wild to having a working exploit has fallen to well under 24 hours. In Indene's reading, this does not mean every flaw has become urgent. It means the few that matter are now exploited before the monthly patch cycle reaches them.

What the sources show

indicator figure source
Median time from discovery of a flaw in the wild to a working exploit well under 24 hours Microsoft, 2026
Typical time for companies to fix a critical internet-facing flaw 30 to 60 days Microsoft, 2026
Incident response cases that began with an exploited public-facing application 24%, up from 15% a year earlier Microsoft, 2026
Mean time to exploit estimated at minus 7 days, that is, before a patch exists Mandiant, 2026
Vulnerabilities exploited per month 18 from January to August 2026, up from 10.5 in 2025 Google Threat Intelligence, 2026
Share of vulnerabilities disclosed in 2026 that were ever exploited 0.23% Google Threat Intelligence, 2026
Breaches in Latin America and the Caribbean that began with vulnerability exploitation 44% Verizon DBIR, 2026

The figures complement each other. The volume of disclosed flaws has exploded: according to Google, the number of CVEs published per month doubled between January and August 2026. But only one in 431 was seen in use by attackers, and VulnCheck shows that of the flaws discovered with AI help in the first half of the year, only 1.3% were exploited. What has shrunk is not the time for every flaw; it is the time for the ones that matter, and they are concentrated in edge devices, remote access and identity.

Gartner recorded the shift from the risk managers' side. In its survey of 316 executives and risk managers in the second quarter of 2026, AI-driven discovery of vulnerabilities appeared on the list for the first time, and straight in first place among emerging risks.

What it means taken together

Recent weeks provided concrete examples. In Citrix NetScaler, Palo Alto Networks' Unit 42 saw reconnaissance starting August 21 and exploitation up to hours before the vendor's bulletin on September 27. In Ivanti Connect Secure, Volexity saw exploitation starting October 3 on a fully updated device; the fix came out on October 13. In both cases, organizations that followed the patch calendar to the letter were exposed for days or weeks without knowing it.

Microsoft draws a direct recommendation from this: fix any new flaw affecting an internet-facing or identity system within 72 hours, and review the previous 90 days for signs that the flaw was used before the fix. That target is far shorter than the 30 to 60 days the same report describes as common practice.

For the board, the consequence is about measurement. The indicator "percentage of patches applied this month" says little when a single edge flaw, exploited for ten days, weighs more than a thousand routine patches. What matters is how long each exposed asset was vulnerable to an exploited flaw, and whether there is proof that no one got in during that interval. In Latin America, where vulnerability exploitation is already the main entry point for breaches, according to Verizon, this calculation weighs even more.

There is also an effect on evidence. Compliance evidence collected in March, such as a scan report or a penetration test, loses value faster when the window between disclosure and attack fits within a week. Evidence needs a date, and the date needs to be recent.

What to do now

  1. Separate the inventory of internet-facing and identity assets (VPNs, gateways, remote access, authentication servers) from the rest and give them a patching target in hours, not weeks.
  2. Track CISA's catalog of exploited vulnerabilities and the vendor advisories for these assets every day, not only in the monthly cycle.
  3. For each exploited flaw that affected the institution, record when it was disclosed, when it was fixed and the result of the search for signs of intrusion in that period.
  4. In the report to the board, replace patch volume with the exposure time of critical assets.
  5. Review risk appetite to reflect that vulnerability discovery has become continuous, as Gartner recommends.

In Indene's reading, patching speed is a control like any other: it is worth what the evidence shows, and evidence ages. The exposure time of a critical asset is an input to the loss range. Read the methodology.

References

Topics

Keep reading

All news