The End of the Patching Era: Security Leaders Urge Shift Toward Post-Exploitation Mitigation

In an era where artificial intelligence has fundamentally altered the offensive cybersecurity landscape, the traditional race to patch vulnerabilities is becoming a losing battle. Organizations can no longer rely on patching as their primary line of defense, according to Dick O’Brien, principal intelligence analyst at Symantec. Speaking at the IRISSCON 2026 conference in Dublin on November 11, O’Brien warned that the rapid acceleration of attack cycles, driven by AI-enabled automation, has effectively rendered the current vulnerability management paradigm obsolete.

The core of O’Brien’s argument lies in the dramatic compression of the time-to-exploit (TTE) window. Over the past year, the rise of sophisticated AI tools has allowed threat actors to identify and weaponize zero-day flaws with unprecedented speed. More alarmingly, frontier models are now capable of chaining together multiple low-severity vulnerabilities—a complex task that often eluded human attackers—to forge a clear path to exploitation that would have previously taken weeks to map out.

The Shrinking Window of Opportunity

Data from the Zero Day Clock, a live dashboard monitoring the time between a Common Vulnerabilities and Exposures (CVE) disclosure and confirmed exploitation in the wild, illustrates a staggering decline in defender reaction time. In 2025, organizations typically had about a week to prepare defenses after a vulnerability was publicly disclosed. By 2026, that window had collapsed to just one day. Projections for 2027 suggest the gap could narrow to a single minute.

“Once you get to a minute, what can you do realistically?” O’Brien asked the audience in Dublin. “We need to start thinking beyond patching to address vulnerabilities.”

This alarming trend was starkly illustrated by the recent PHP2Shell vulnerability, which surfaced in October 2026. The speed of the subsequent attack was unprecedented; initial reports indicated that the first confirmed exploitation attempts occurred a mere 19 minutes after the bug was made public. Even more concerning, Amazon reported detecting exploitation attempts of the same vulnerability four days before the official disclosure, suggesting that attackers are not only faster at reacting to news but are also aggressively hunting for flaws before they are even acknowledged by vendors.

The Rise of Agentic AI in Cyber Warfare

Looking ahead to the next year, O’Brien anticipates a significant shift in how threat actors deploy their resources. The industry is moving away from an era where AI serves primarily as a co-pilot or assistant for manual hacking tasks. Instead, we are entering a phase defined by "end-to-end agentic orchestration," where autonomous AI agents conduct the entire lifecycle of an attack without direct human intervention.

This transition marks a critical inflection point for security teams. When attacks are executed by autonomous agents, the speed and scale of operations increase exponentially, making it increasingly difficult for human-led defensive teams to identify, track, and disrupt malicious activity in real-time. These agents can iterate through defensive environments, test configurations, and pivot through networks at machine speed.

A recent, high-profile example of this reality occurred in September 2026, when the Dutch Institute of Vulnerability Disclosure (DIVD) fell victim to an attack. In this incident, AI agents independently executed post-compromise tasks, demonstrating the efficacy of autonomous exploitation. Symantec’s subsequent analysis of the DIVD assessment report revealed a harrowing reality: while the initial breach was detected within 19 minutes, the organizational response did not begin for another 19 hours, followed by an additional nine hours to successfully contain the threat.

For O’Brien, this disparity is the defining challenge of the current security environment. “This is what we’re dealing with,” he commented. “It’s an excess of 24 hours, and you know you’re not going to be able to compete with something operating at machine speed.”

Adopting an ‘Assume Exploit’ Mindset

Given the speed at which these modern attacks unfold, O’Brien argues that the security industry must undergo a psychological and operational shift. Organizations can no longer operate under the assumption that they can prevent every compromise. Instead, the focus must shift toward assuming that exploitation is inevitable and prioritizing the ability to limit damage once an attacker has gained a foothold.

“Stop measuring your mean time to patch and start measuring your mean time to mitigate,” O’Brien advised. “Assume an exploit is going to happen and plan your preparedness for that.”

The shift requires a move toward resilient infrastructure and robust post-compromise monitoring. Security teams are encouraged to focus on mitigation tasks that can be performed proactively—long before a specific vulnerability is even identified. By hardening systems, limiting lateral movement, and implementing zero-trust architectures, organizations can create a defensive environment that is inherently more resistant to the sudden, machine-speed incursions of AI agents.

This proactive stance also involves re-evaluating the role of detection. In the past, detection was often focused on identifying the specific signatures of known exploits. In the future, this approach will be insufficient. O’Brien emphasizes the necessity of integrating detection and protection technologies across multiple control points capable of identifying behavioral anomalies. These systems must be tuned to spot the subtle, non-human patterns of rogue or malicious AI agents, rather than relying on the static indicators of the past.

As the threat landscape continues to evolve, the distinction between a vulnerability and an exploit will continue to blur. The goal of security is no longer to keep the perimeter perfectly sealed—an impossible task in the face of AI-driven reconnaissance—but to ensure that when an adversary manages to slip through, the architecture of the organization is structured to detect the activity instantly and isolate the threat before it can reach critical assets.

Ultimately, the lesson of 2026 is that the velocity of digital threats has outpaced the velocity of human remediation. By shifting the mandate from patching cycles to rapid mitigation and behavioral resilience, security leaders hope to reclaim a measure of control in a world where the speed of attack is measured in seconds. This fundamental realignment of priorities is not merely a suggestion for the future; according to O’Brien, it is an urgent necessity for any organization looking to survive in an environment where AI-orchestrated attacks are becoming the new standard.