In 2025 alone, nearly 48,000 CVEs were published.
AI-driven discovery: machine speed meets human limits
Artificial intelligence models such as Anthropic’s Claude Mythos and OpenAI’s ChatGPT have accelerated vulnerability discovery from a human-paced craft to an industrial capability operating at machine speed. The result is a surge of findings across vendors, researchers, and threat actors simultaneously. That acceleration reveals a core mismatch: discovery has become near-instantaneous, while remediation still depends largely on human teams working in scheduled cycles.
The consequence is what cybersecurity leaders now call the Patch Apocalypse — a permanent shift in which vulnerability scale, speed, and exploitability outpace traditional patch remediation approaches. The source warns that “fewer than one percent are patched fast enough,” and that existing CVE infrastructure cannot absorb the output volume generated by AI-assisted discovery.
Zero-days and n‑days: exploitation has changed
The source identifies two distinct shifts in exploit risk. First, zero-day exploitation has “stabilized at an elevated baseline.” The report cites an illustrative comparison: where traditional methods produced two working Firefox exploits, AI-assisted approaches generated 181 — a “90-times improvement in success rate.” That dynamic turns zero-days from rare, strategic assets into industrial inputs limited more by compute than by expertise.
Second, known vulnerabilities (n‑days) continue to drive most real-world breaches. Time-to-exploit has collapsed because AI models can reverse-engineer patches and perform code differencing quickly, turning newly disclosed CVEs into reliable exploits almost immediately. Attackers often reserve zero-days for strategic operations while relying on n‑days for volume breaches.
Why monthly maintenance and CVSS-based triage no longer scale
The established model — inventory, severity-based prioritization, monthly or quarterly patch windows, and ITIL-style approvals — scales linearly with human effort. Threats now scale with compute availability, creating three operational dilemmas for government and education organizations identified in the source:
- The continuous delivery dilemma: critical vulnerabilities that appear between maintenance windows force organizations into impossible choices when “emergency” patches become weekly events.
- The false signal of severity scores: Common Vulnerability Scoring System (CVSS) ratings measure theoretical impact, not actual exploit risk; teams frequently prioritize “critical” but unexploited flaws over “medium” vulnerabilities being actively exploited in the wild.
- The asset visibility gap: many organizations lack real-time visibility into deployed software versions, making risk-based prioritization impossible when you cannot reliably identify the assets at risk.
These failures mean the relevant unit of cyber risk is no longer the vulnerability in isolation but exploitability and the window of exposure.
What this means for public sector organizations, Google Chrome, and security teams
Public sector organizations face a unique pressure: discovery and exploitation are occurring at machine speed, while institutional patching rhythms remain human-scale. The source argues public sector actors can no longer rely on monthly maintenance windows and must confront the reality that emergency patches may be a regular occurrence.
Major vendors already changing cadence are cited as part of the adaptation: Google Chrome has moved to weekly patch releases, and the source expects more vendors to follow that cadence. For vendor product teams, that implies shifting release practices, support models, and communication with customers.
Security operations and IT teams are urged to rethink prioritization and tooling. Chris Goettl, VP, Product Management, Endpoint Security at Ivanti, is quoted: “Many organizations currently struggle to keep up with priority updates resolving exploited vulnerabilities when they occur outside of their normal monthly maintenance.” Teams will need better asset visibility, faster remediation automation, and new processes that do not depend on linear human scaling.
An exposure-based approach and autonomous endpoint management
The source prescribes a conceptual pivot: redefine security risk around exposure and exploitability and build an exposure-based patch management framework. That framework would pair more frequent patching with autonomous endpoint management capable of moving “at the speed of the threat.”
Concretely, the argument is for shorter response windows, continuous patching rather than monthly batches, and investments in the foundational data layer that tells security teams where software runs and which assets are vulnerable. Without that visibility and automation, traditional severity-driven queues and manual triage will continue to lose ground to machine-accelerated attackers.
The Patch Apocalypse is not a momentary spike; the source frames it as a durable operational reality. It concludes: “The future requires redefining how organizations conceptualize security risk, which mandates building an exposure-based patch management framework with autonomous endpoint management that can move at the speed of the threat.” Will agencies reorganize processes, tooling, and vendor relationships quickly enough to match machine-speed discovery? The report implies that question remains urgent.
