GoKawiilOPINION
On April 7, 2026, Anthropic announced Project Glasswing, which changed how every security team operates. Claude Mythos, an AI-frontier model that found thousands of high-severity vulnerabilities, including flaws in major operating systems and Web browsers, many of which survived for decades of human review and automated security tests. Of which, less than 1% was fully patched. This is a patch physics problem rather than a patch management problem. You cannot match machine-speed discovery with a remediation cycle that runs on human time.
Before Mythos, in 2025, 46,407 CVEs were published, up from 40,009 in 2024, a 16% year-over-year increase. The National Institute of Standards and Technology enriched nearly 42,000 CVEs in 2025, 45% more than any prior year but still couldn't keep pace with the growing volume of submissions.
Now, imagine Mythos vulnerability discovery on top of this baseline; the vulnerabilities identified will flow downstream to every enterprise. When a critical zero-day is found in a kernel or widely used open source library, CVEs get published, scanner signatures get updated, and suddenly every organization running that software has a new critical finding to address.
Related:From Bobmojis to Bobbleheads: How the Democratic Party Built a Security-First Culture
In parallel, look into the exploitation window. In 2018, the median time from vulnerability disclosure to first observed exploit was 771 days; by 2021, it was 84 days; by 2023, it was six days; by 2024, it was four hours. It didn't stop here; in 2024, a Mandiant analysis found something more unsettling: an average time-to-exploit of negative-one day, which means attackers are now exploiting vulnerabilities before patches are even publicly available.
As mentioned in INDUSFACE, the median time to exploit is now under five days, and the average time to remediate a critical vulnerability exceeds 60 days. That is a 12-to-1 gap between attacker speed and defender speed. The math here is brutal.
Traditional vulnerability management is sorting by CVSS, patching 9s and 10s, clearing the critical queue, and moving down the list. This feels systematic, but it won't work anymore. CVSS was never designed to prioritize patching, yet it became a default operating logic for most security teams. The problem is structural; CVSS scores in isolation measure the maximum impact against an abstract target.
In 2025, 28% of exploited vulnerabilities had medium CVSS base scores, which means organizations using CVSS-first prioritization are deprioritizing more than a quarter of the vulnerabilities attackers are actually using. Chris Gibson, executive director of FIRST, said that organizations using CVSS base scores alone for prioritization are "the least apt and accurate."
Related:Is There Really a Fix for CISO Fatigue?
... continue reading