Disclosure Tempo

A vendor patches in weeks. An agent operates in minutes. The disclosure timeline was written for adversaries that moved at the speed of quarters, and the mismatch is no longer theoretical.

The window that no longer exists

Coordinated disclosure is one of the security industry's genuine institutions. Report to the vendor, give them time, publish responsibly. The institution assumes a survivable window between report and patch, and for human-speed threats the assumption mostly held.

Agent-speed attacks do not produce a window. They produce a moment. The attack loop that runs in minutes does not wait for a patch cycle, and the disclosure calendar that made sense against human adversaries reads like a joke against an automated one. The window is not shorter. It is gone.

What the tempo gap breaks

Three things. The embargo, because there is nothing meaningful to embargo when exploitation is fully automated and the technique propagates at copy-paste speed. The patch race, because the adversary's iteration loop is faster than the vendor's release process. And the grace period, which only ever existed because exploitation required effort, and effort takes time.

None of these institutions failed a moral test. They failed a clock test. The clock changed.

What survives the tempo change

What survives is speed at the deployment edge: detection inside the loop, thresholds ranked in advance, interruption authority granted before it is needed. The controls that do not depend on the window are the ones that still work when the window closes.

Disclosure tempo has to match the tempo of the loop, or the disclosure protects nobody. The institutions that internalize that first will not be the ones with the fastest patch pipelines. They will be the ones who stopped needing the window.