"The exposure window - the gap between the moment a vulnerability becomes exploitable and the moment your team fixes it - is the time an attacker has to do actual damage." — Ryan Blanchard, Director of Product Marketing, XM Cyber
The exposure window, in numbers
Anthropic's April 7 Mythos reveal catalyzed industry debate about volume: how many new CVEs, how quickly discovery scales, and how long before adversaries weaponize findings. Those are valid questions, but they stop short of the metric that actually determines breach risk: the exposure window. The scale is stark. In 2025, 48,185 CVEs were disclosed — a 22% rise over 2024 — and projections for 2026 put new disclosures at about 66,000. At the same time, average eCrime breakout time in 2025 fell to 29 minutes, while PCI DSS still allows 30 days to remediate a critical vulnerability. That mismatch turns a compliance calendar into a thousand-to-one handicap against active attackers.
Mobilization: where detection stops and risk remains
Gartner's CTEM framework breaks vulnerability management into five stages — scoping, discovery, prioritization, validation, and mobilization. The first three stages now run at machine speed and validation has improved through automated attack-path testing. Mobilization, however, still moves at organizational speed. The security team can identify and prioritize exposures quickly, but a different group — with separate approval chains, change windows, and competing priorities — typically owns the actual remediation. That handoff is the single point keeping the exposure window wide.
Recent research cited in the source illustrates the consequence: high and critical application vulnerabilities take an average of 55 days to remediate, and nearly half of enterprise vulnerabilities remain unpatched after a full year. Legacy systems, OT environments, and production infrastructure commonly delay fixes because of potential business impact, and identity-related findings like excessive privileges may have no patch at all, landing instead in ambiguous queues with no single owner.
AI-driven discovery forces a clocked response
AI-driven discovery compresses the upstream lifecycle so rapidly that proactive and reactive security teams now effectively share a stopwatch. When disclosures can move to weaponization in hours and breakout time is measured in minutes, quarterly patch metrics and percentage coverage by severity stop being meaningful measures of risk. The article argues that proactive teams must adopt the SOC's speed-based metrics — dwell time, mean time to respond, containment speed — because no remediation pipeline can consistently outrun a 29-minute breakout solely by adding more traditional approvals or weekly change windows.
What this means for technologists, policymakers, and enterprises
- Technologists and security teams: must shift measurement from patch counts and backlog size to how long critical assets remain reachable — turning remediation speed into a business-risk metric rather than an operational metric alone.
- Policymakers and regulators: CISA's BOD 26-04 is already a step toward prioritizing exploitability and asset context over CVSS-first approaches, but the directive addresses which vulnerabilities to fix first, not how rapidly organizations can mobilize to do so.
- Enterprises and procurement leaders: face a reality where traditional change-control tempos and fragmented ownership materially widen the exposure window; they need to narrow mobilization pathways and clarify ownership for findings that are not simple software patches.
Shrinking the blast radius with attack-path analysis
Because no organization will close every exposure at attacker speed, the practical strategy is to reduce the blast radius — the set of critical assets an attacker can reach from an exploitable exposure. The 2026 Verizon DBIR is cited as making the case for attack path analysis: not every exposure leads to a critical target, and mapping paths reveals which findings are dead-ends and which open routes to valuable assets. Focusing mobilization on a finite set of attack paths transforms remediation from an unfinishable backlog into a prioritized effort where time-to-fix becomes a measurable business risk.
Mythos didn't create the exposure window; it widened the timeline pressure. The analytic shift the article prescribes is concrete: measure how long critical assets stay reachable, prioritize fixes by exploitability plus business impact, and treat remediation as a speed and ownership problem as much as a triage problem. If mobilization remains a procedural handoff, the window stays open and attackers will keep a minute-by-minute advantage.
Read the original piece: https://thehackernews.com/2026/07/mythos-didnt-break-your-security.html
