AI is reshaping the vulnerability landscape by compressing the time between discovery and exploitation. According to Fernando Maymi of Anomali, the gap that used to be measured in days, weeks, or months has in some cases shrunk to minutes — as little as 25 minutes from exploitation to data exfiltration.

Practically, this means:

• Attackers can use AI to rapidly identify and weaponize newly disclosed vulnerabilities.
• Security teams have far less time to test and roll out patches before an issue is actively exploited.
• Traditional patching rhythms and long testing windows are becoming less viable.

As Brian Wilson, CISO at SAS, points out, the core challenge is the gap between machine speed and human speed in governance and patching. CISOs are increasingly asking executive teams for flexibility to patch first and ask questions later, accepting that some changes will need to be made quickly, with more rigorous testing and quality checks happening immediately after deployment.

Traditional 30-60-90 day patch windows were designed for a world where attackers needed time to analyze and exploit vulnerabilities. AI is changing that assumption.

Several trends are putting this model under pressure:

• AI-driven speed: Exploits can now be developed and executed in minutes, not weeks, which makes long patch windows risky.
• Rising volume of vulnerabilities: Security teams are seeing more patches and updates from third-party vendors, and many organizations are increasing how often they test their own software.
• Combining “small” issues into big ones: As Intuit CISO Atticus Tysen and ETS/PSI CISO Wally Dalrymple note, advanced models can combine multiple low- and medium-level vulnerabilities into a critical exploit. That means low-level issues can no longer be safely deferred.

As a result, SOCs are starting to treat low-level risks almost as aggressively as critical ones. This shift could effectively end the traditional 30-60-90 day guideline. As Brian Wilson puts it, the priority is to demonstrate the ability to act quickly, even if that goes beyond what compliance checklists require.

Security leaders are reimagining vulnerability management by using AI on the defensive side to match attacker speed.

Key ways AI is being used for defense include:

• Faster vulnerability analysis and triage: Peter Bailey from Cisco Security notes that AI tools have a “supercharged” ability to analyze vulnerabilities and prioritize what matters most.
• Alert filtering and false positive reduction: Intuit’s SOC uses AI to review tier 1 alerts, filtering out false positives so analysts can focus on genuine tier 2 and 3 issues.
• Configuration and access reviews: AI is used to scan for application misconfigurations and overbroad access permissions, helping teams tighten their environment proactively.
• Code review support: Intuit has built AI agents to assist in reviewing AI-generated code, adding another layer of scrutiny before deployment.

On the process side, organizations are also rethinking patch cadence. As Wally Dalrymple points out, teams can no longer wait for predictable cycles like “Patch Tuesday”. They are moving toward continuous or near-continuous remediation, patching as soon as issues are validated.

This faster motion does introduce risk — for example, the chance of breaking an application with a rushed patch. Dalrymple’s view is that this simply raises the bar for post-patch testing, process maturity, and quality controls. In other words, every organization now needs to patch faster and invest in stronger validation to keep systems stable.