Zero-Day Every Day: Part 3 of 3

Part 3 of the AI & Cybersecurity Series

The Defender's Playbook for the AI Attack Era

29 Minutes

That's the average time it now takes an AI-assisted attacker to go from initial access to lateral movement inside your network.

The fastest recorded breakout? 27 seconds.

For comparison, your average IT change approval process takes longer than that. Probably much longer. Probably involves a Teams thread, two reschedules, and a guy named Greg.

Here's the part nobody wants to say out loud:

Everything the security industry built over the last 30 years was designed for attackers who moved at human speed.

Patch the vulnerability before they exploit it. Respond to the alert before they pivot. Get to the incident before it becomes a breach.

That model is dead.

Reality check:
This is not a theory. The people writing these playbooks now are the ones who spent years building attack chains from the other side. What follows is the perspective that produces it.

The Patch Cycle Is Already a Corpse

(Or: the slow, bureaucratic ritual that assumed attackers were also slow and bureaucratic.)

The old model only worked when defenders had time. Defenders no longer have time.

The classic flow made sense back when it worked:

• vulnerability disclosed
• CVE assigned
• Vendor releases a patch
• IT deploys it
• Everyone goes back to lunch

A slow, sequential ritual that assumed the attacker was as bureaucratic as you are. For decades, that was true.

Then the gap collapsed.

In 2021, the average time from vulnerability disclosure to active exploitation was 771 days. By 2025, that number had cratered to 44 days. And that's the average meaning; half of the exploitations happen faster.

According to Mandiant's M-Trends 2026 report, 28.3% of CVEs are now exploited within 24 hours of public disclosure.

Meanwhile, the average enterprise takes 74 days to remediate a known critical vulnerability.

Read that again.

Translation:
The change request to patch the last critical vulnerability is still open. The one before it never got approved. Meanwhile, the attacker finished the kill chain during your standup.