The Velocity Gap

PART 01 The velocity side is measured — and the measurements are brutal

EstablishedThe Sysdig Zero Day Clock, built on 3,515 CVE-exploit pairs from CISA KEV, VulnCheck KEV, and XDB, tracks median time-to-exploit crossing each threshold. In 2018 the median time from disclosure to first observed exploit was 771 days; by 2021 it compressed to 84 days, by 2023 to 6 days, by 2024 to roughly 4 hours, and in 2025 the majority of exploited vulnerabilities were weaponized before they were even publicly disclosed. [Resilient Cyber]

That last clause breaks the traditional model. Mandiant's M-Trends 2026, built on over 450,000 hours of incident response, reports that the mean time to exploit is approximately negative seven days — exploitation now routinely precedes disclosure. CrowdStrike found 42% of exploited vulnerabilities were attacked before public disclosure, and VulnCheck recorded 28.96% of 2025 known-exploited vulnerabilities with exploitation evidence on or before the publication day, up from 23.6% in 2024. [Mandiant via Stingr AI] [VulnCheck]

The pipeline is so saturated the enrichment infrastructure has buckled: NIST formally moved the National Vulnerability Database to a triage model on April 15, 2026, committing to enrich only the 15–20% of incoming CVEs intersecting KEV, federal, or critical-software lists. My read: defenders face a firehose where most items will never be officially analyzed and the dangerous minority is already exploited before the ticket exists. CVSS — designed for a 30-day world — is now actively misleading as a prioritization signal.

PART 02 The remediation side moved too — just not enough

EstablishedIn 2025, mean time to remediation dropped approximately 47% across all severity levels (Synack 2026 State of Vulnerabilities) — a genuine, large improvement from automated discovery, AI-assisted triage, and continuous validation. [Synack via Help Net]

But absolute time remains catastrophically out of step. The average time to remediate a known high/critical CVE is now 74 days (Edgescan 2025), and 45% of vulnerabilities in large-company systems are never remediated. For cloud identity it is worse: organizations take nearly eight months to fix weak passwords and excessive third-party permissions, with only 31% ever fully resolving them, and 37% still ran admin cloud accounts without MFA. [Edgescan via THN] [2026 DBIR via Token]

Hold the numbers together. Exploitation: hours, or negative days. Remediation: 74 days for criticals, eight months for identity, "never" for nearly half the estate. A 47% improvement on a 74-day baseline lands you at ~39 days against an adversary on a sub-day clock.

PART 03 Where AI specifically tips the balance toward offense

EstablishedOn exploit development, the supply-chain signal is the cleanest proxy: malicious packages in public repositories grew from 55,000 in 2022 to 454,600 by 2025 (Sonatype), with notable leaps in 2023 — the year GPT-4 released — and 2025, a marquee year for agentic coding. JudgmentCorrelation is not proof; I flag the GPT-4/agentic-coding alignment as inference, not an established mechanism — but the timing is hard to wave away.

EstablishedOn execution, the Verizon 2026 DBIR gives the most concrete metric: the median threat actor used AI assistance across 15 different MITRE ATT&CK techniques, some across 40 or 50, and attackers are beginning "more agentic approaches" where AI makes autonomous decisions about targets and progression. OWASP frames 2026 as the year AI moved from theoretical risk to a real-world force multiplier. [OWASP GenAI]

The structural problem is that the speed advantage compounds. AI-orchestrated campaigns run recon-to-exploit in hours, adapt to detection in real time, and human-paced SOC workflows are structurally too slow to counter this. Offense can be fully automated end-to-end; remediation still bottlenecks on human decisions — change boards, maintenance windows, regression testing, sign-off. AI removes the human from the attacker's loop faster than any organization will remove it from the defender's.

PART 04 Mythos as the inflection signal — handle with epistemic care

What is reported, by third parties: Anthropic's Mythos model demonstrated autonomous, multi-step network exploitation — one account describing a 32-step network attack completed autonomously in hours — alongside a Claude Code source leak and rapid discovery of subsequent vulnerabilities. [Adversa AI] [Foresiet]

PART 05 What actually follows for defenders

1. Prioritize on exploitation evidence, not severity. Feed KEV, EPSS, and threat-intel exploitation signals directly into patch ranking and explicitly demote CVSS. With NVD no longer enriching most CVEs, exploitation telemetry is the only scalable signal left.
2. Assume compromise of the unpatched window; invest in containment. When time-to-exploit goes negative, the patch can't be the primary control because the exploit predates it. Microsegmentation, least-privilege, and blast-radius limits decide outcomes once initial access is a given.
3. Govern non-human and agent identities as a first-class attack surface. An agent that runs code perfectly 10,000 times looks normal to SIEM/EDR built for human anomalies. Layering thousands of agents onto eight-month-old identity sprawl is how a wound becomes fatal. Identity is the control plane.
4. Deploy AI on defense where humans are the bottleneck — triage, correlation, automated containment — to remove the latency the attacker has already removed from their loop. The 47% gain proves it works; it isn't sufficient alone.
5. Secure your own AI supply chain as production infrastructure. LiteLLM-class RCEs in AI routing layers and MCP/prompt-injection vectors make your defensive AI a high-value, externally reachable target. There is no grace period for an RCE in a production AI integration layer.