Three things landed this week that, read together, make one of the most uncomfortable charts in security. None of them is a breach. All of them are about time.
Exhibit A: Machines Are Finding Bugs Faster
The UK's NCSC published an assessment saying widespread AI cyber tools have "almost certainly" increased zero-day discovery. The good news half of that report: defenders who set these tools up well patch faster too.
Then OpenAI described an agentic pipeline that, according to The Hacker News's reporting on OpenAI's write-up, took 2,308 candidate Linux kernel findings, reproduced 1,724 of them in about 30 hours, and produced 948 working local privilege escalation exploits for a commonly used distribution. The pipeline also generates patches, with human review before anything goes to maintainers. That's a defensive project, and I'm glad it exists. It also tells you what the attacker side of this looks like with a big enough budget.
Exhibit B: Appliances Are Patched Slowly
On November 2, Microsoft published an analysis of vulnerabilities seen in real-world attacks, using its exposure management data. The patching numbers, in Microsoft's words: the median vulnerability is patched in about two weeks on Windows workstations, more than a month on Windows Servers, 10+ weeks on Linux servers and Mac apps, "and beyond a year on network appliances."
Beyond a year. For the boxes that sit on the edge of the network, facing the internet, often running as root.
Exhibit C: This Week's Appliance Bugs
Just this week: a Zyxel switch patch that didn't patch the bug being exploited, and a Barracuda Email Security Gateway chain from no login to root, with the details now public. Last week it was PAN-OS management interfaces and PHP2Shell. Before that, Ivanti and Cisco SD-WAN.
Do the Math
If bug discovery speeds up and appliance patching stays at a year, the window between "someone knows about this" and "you're fixed" doesn't shrink. It grows. And it grows in exactly the place attackers like most: devices with no EDR, limited logging, and a management interface that too often faces the internet.
I don't think the answer is "patch faster," although, yes, patch faster. A year-long median isn't laziness. Appliances need maintenance windows, the upgrade can break things, and the team that owns the firewall is also the team that owns everything else. You can't operations-heroics your way out of a structural problem.
The structural answer is to have less that needs patching in a hurry. Here's my bias showing (I work at Zscaler, and this is basically our pitch, so weigh it accordingly): the fewer internet-facing appliances you run, the fewer of these year-long windows you own. Cloud-delivered services get patched by the provider, which moves the problem to someone whose full-time job is patching. That isn't magic either. Cloud providers ship bugs and have outages too, Zscaler included. But it changes who's holding the year.
What To Do
- Measure your own number. What's your median time to patch on edge devices? If you don't know, that's the first finding.
- Get management interfaces off the internet. Every single appliance bug this week needed the admin UI to be reachable. This is the cheapest fix in security.
- Shrink the appliance count. Every box you retire or replace with a service is one less year-long window.
- Put AI on your side. The NCSC's point is real: defenders using these tools to find and fix bugs in their own code and configs get faster too.
- Plan for the bug you can't patch yet. Segment appliances, log what you can, and have a rebuild plan, because "assume compromise" keeps showing up in vendor advisories for a reason.
Bottom Line
Discovery is getting faster. Appliance patching isn't. Either you close that gap by patching faster, or by owning fewer things that need patching. Realistically, do both.
Sources: Microsoft Security on exploited vulnerabilities, UK NCSC assessment on AI and cyber intrusion, OpenAI, A thousand fewer paths to root, The Hacker News on OpenAI's pipeline, and The Hacker News ThreatsDay roundup