Vulnerability Management

The average time between a flaw’s disclosure and its exploitation has fallen from 63 days in 2018 to minus seven days in 2025: attackers now typically exploit a flaw about a week before a patch exists.¹

On the defender’s side, the time to patch hasn’t moved. It still sits at roughly two months.⁶

Vulnerability exploitation is now the leading initial access vector, overtaking stolen credentials for the first time in nearly two decades of reporting.²

MOVEit Transfer showed what that looks like at scale. In 2023, the Cl0p ransomware gang exploited a zero-day SQL injection in the file-transfer tool before any patch existed. Two weeks after the patch shipped, more than 30 per cent of instances were still unpatched, and the breach eventually hit more than 2,700 organisations.^11,12,13

In June 2026, ASD’s ACSC issued a national alert on a widespread credential-based campaign against Fortinet firewalls and VPN gateways, and named keeping those devices patched among its required mitigations.¹⁴

AI is compressing the attacker's timeline, and its effect is accelerating.

Frontier AI models now automate work that used to take skill and time: reading a fresh disclosure, finding the exploitable path, generating working attack code. In controlled evaluations, the fastest models took a published disclosure to working exploit code in about 20 hours, so even a flaw that is disclosed before it’s exploited now leaves defenders less than a day.^9,10

Frontier labs now run named evaluations of exactly this capability, Anthropic's Mythos and OpenAI's Daybreak among them, and model performance on narrow cyber task suites is roughly doubling every few months.^9,10

That capability is no longer confined to the lab. Since Anthropic disclosed Mythos in April 2026, the number of high- and critical-severity vulnerabilities published by major technology vendors has gone vertical: roughly 2,500 in July 2026 across 21 tracked firms, about five times the monthly record set before the announcement.¹⁶ Much of that is AI turned on the problem from the defender’s side, surfacing flaws before attackers reach them. The uncomfortable half is that the same capability, pointed the other way, weaponises them just as fast: the backlog waiting on a patch is now larger than any monthly cycle was built to clear.

Not all of this capability sits behind a frontier lab's guardrails. Open-source and leaked model variants circulating outside those evaluations answer to no usage policy and cost nothing to run, putting comparable capability within reach of anyone, not just well-resourced attackers.⁵

The craft that once slowed exploitation down has been partly automated away. The craft of remediation has not.

Most Australian organisations are already patching. The catch is what they’re patching: standard update tooling was built for the operating system and a narrow set of first-party applications, a minority of what actually runs on the endpoint. It was never built for the laptop offline on leave, the remote worker whose device rarely touches the office network, or the firewall sitting outside that tooling altogether. Even across the managed fleet, some devices miss a given patch in every cycle, because an agent has broken, a disk is full, or the machine isn’t on when the maintenance window opens. Then there are dependencies: patch one component ahead of the applications built on top of it, and the fix is what takes the system down.

That uncovered majority is also where Australian obligation bites hardest, because third-party and edge-facing software is what attackers target first. Two of ASD’s Essential Eight controls, Patch Applications and Patch Operating Systems, sit in this domain, and the timeframe for internet-facing systems judged critical or under active attack is 48 hours. ASD calls patch currency the single most effective technical control to disrupt initial access.³ That is a remediation timeframe, not a scanning cadence; Essential Eight sets its own, shorter cycle for finding the vulnerability in the first place.