Patch Cycles Meet Agent Speed

A patch cycle assumes the window between disclosure and exploitation is days. Agent-speed attacks close that window to minutes, and the patch cycle was never designed for that. The view from the deployment side is different from the vendor's view, and worse.

The window was a treaty, not a law

Coordinated disclosure worked because both sides honored a cadence. Vendors needed weeks to ship. Attackers, mostly human, needed weeks to weaponize. The treaty held because both clocks ran at human speed.

When the attack loop automates, weaponization time collapses. The technique propagates the moment it is disclosed, or before, because the agent that found it does not attend conferences. The window stops being a détente and becomes an invitation.

What deployments actually face

From inside a deployment, the vendor's patch timeline is only half the problem. The other half is the organization's own patch process, with its change review and its maintenance windows and its governance. An agent-speed attack does not read the change calendar either.

The math is unforgiving. Weeks to patch, against minutes to exploit, with the deployment's own process adding more weeks on top. Any defense that depends on winning that race has already lost it.

What does not depend on the race

The controls that survive are the ones that do not need the window. In-loop detection. Ranked thresholds. Interruption authority granted before the incident. None of these care how fast the patch ships, because none of them wait for the patch.

Patch cycles meet agent speed and lose the race they were built for. The deployments that hold up are the ones that stopped entering the race, and started building the controls that do not require coming in first.