How fast does a newly disclosed vulnerability get exploited? Fast enough that the monthly patch cycle no longer describes reality. One analysis of thousands of CVE-exploit pairs traced the median time between disclosure and first observed exploitation, and watched it fall from more than two years in 2018 to a matter of hours by 2024. The playbook most security teams still run, with its quarterly scans, monthly patch windows, and tickets that sit in a queue until someone gets around to them, was built for a world that no longer exists.
That collapse forces a series of decisions. What do you patch first? Who owns the fix? When does a scanner finding become a ticket, and when does it become an incident?
The answers determine whether your program is defending an attack surface or watching one.
Decide What Counts as "Urgent" Before the Next Advisory Drops
Severity is not urgency. A CVE with a CVSS score of 9.8 that no attacker has touched in three years is a lower operational priority than a 7.5 with working exploit code circulating this morning. Teams that treat the two the same way spend their patch windows on the wrong things.
The practical move is to define, in writing, what triggers the emergency lane before the next advisory lands. Two questions do most of the work:
- Is there evidence of exploitation in the wild, or a public proof of concept a mid-skill attacker could weaponize today?
- Does the vulnerable asset sit on a path an attacker would actually take, meaning internet-exposed, holding sensitive data, or a stepping stone to something that does?
Write the rule down. When the next zero-day starts trending, you want a decision, not a debate.
Decide Where the Handoff From "Found" to "Fixed" Actually Lives
Most of the hours between disclosure and remediation disappear in transit rather than in patching itself. A scanner produces a finding, the finding becomes a ticket, the ticket gets assigned to an owner, the owner waits on a change window, and eventually a verification scan confirms the fix took. Every one of those handoffs is a place where hours turn into days.
The decision is whether to keep security and IT operations as separate organizations with a queue between them, or to collapse the workflow so a finding, its owner, its fix, and its verification live in the same system. Continuous platforms that unify monitoring, prioritization, and automated remediation, like the approach described in this CyberAttack.ai coverage on siamnewsnetwork.net, exist because that transit time is where the exploitation window opens.
You do not have to buy a platform to make progress here. You do have to name an owner for every asset class, agree on a service level for critical fixes measured in hours rather than days, and stop letting tickets close on the promise of a patch instead of proof of one.
Decide How Much to Automate Before a Human Signs Off
Automation is one of the few practical ways to keep up with a four-hour exploitation window. It is also the fastest way to take a production system down in the middle of the night if you point it at the wrong asset. The real decision is not whether to automate. It is where the line sits between actions a machine can take on its own and actions that require a human to approve.
- Auto-apply on low-risk, well-understood assets: browser updates on endpoints, patches to non-production systems, signatures and rules that revert cleanly.
- Auto-stage with human approval on production systems and anything customer-facing: the patch is prepared and tested in a lower environment, and a named owner clicks deploy.
- Human-only on fragile or heavily regulated systems: OT, medical devices, and legacy platforms where an unplanned reboot has consequences well beyond IT.
Write the split down for each asset class in advance, so nobody is inventing risk tolerance at 3 a.m. during an active advisory.
Decide Whether Your Patch Program Is a Project or a Practice
NIST's current guidance frames patching as ongoing preventive maintenance rather than a series of scheduled events, and the enterprise patch management guide lays out identifying, prioritizing, acquiring, installing, and verifying patches as a continuous loop rather than a quarterly project. The reframing matters because a project has an end date. A practice has a cadence, an owner, and a metric.
The decision here is what you measure. Time to detect is comfortable to report and largely useless as a predictor of loss. Time to remediate, meaning the clock running from disclosure through a verified, deployed fix on the affected assets, is harder to produce and far more honest about how exposed you are.
Pick the harder number. Report it monthly. Let the trend line, not the dashboard color, drive the next investment.
Rewrite the Playbook Before the Next Advisory Forces the Issue
None of this requires unusual tooling. It requires a small set of decisions made in daylight: what counts as urgent, who owns each handoff, where the automation line sits, and what number you report on. Make them now, and the next four-hour advisory is a busy afternoon. Put them off, and it is an incident report.
