As of April 2026, the paradigm of how software vulnerabilities are discovered and addressed is undergoing a seismic shift. Advanced AI models from Anthropic and OpenAI can now autonomously detect exploitable weaknesses in production software, reducing what used to be a labor-intensive sixty-day process to just four hours, as highlighted in Melissa Hathaway's recent perspective for the Cyber Defense Review. Notably, Anthropic's model, named Mythos, has identified critical flaws in an astounding 99 percent of prevalent operating systems and browsers, with at least 40 major software and hardware vendors adopting these tools.
Hathaway articulates a stark warning: the accumulated technical debt from over four decades of the "deploy first, fix later" mentality is set to trigger an unprecedented wave of patches over the next one to two years, rather than the gradual accumulation seen over the last decade. Unfortunately, much of the ongoing discourse concentrates solely on IT-related metrics like disclosure timelines and patch cycles, neglecting the real-world implications of these updates.
Balancing Discovery Speed and Remediation Challenges
The challenge lies in reconciling the pace of vulnerability discovery with the slower tempo of remediation activities. In enterprise IT environments, securing a fix for critical vulnerabilities within seven days is a challenging yet feasible target: reboot the server, roll back if needed, and face minimal downtime.
Contrast this with the landscape of operational technology (OT), where immediate remediation is not an option. Availability and safety take precedence over confidentiality; thus, processes cannot be interrupted arbitrarily for patching. The scheduled maintenance windows can be infrequent, sometimes occurring only quarterly or annually, which creates a structural gap that cannot be ignored.
On the other hand, attackers are also benefiting from this rapid vulnerability discovery. Security models can produce a viable exploit almost instantly after a weakness is disclosed. Hathaway mentions that the Chinese 360 Digital Security Group's AI tools have already unearthed approximately a thousand fresh vulnerabilities, emphasizing that no sector is immune to these risks. OT environments, with long-standing assets that rarely receive updates, present a ripe opportunity for exploitation. With discovery operating at machine speed and remediation stuck at plant speed, the widening gap poses significant challenges for organizations.
The Realities of Patch Management in OT
A comprehensive understanding of why traditional advice to "patch faster" falls short is critical. It's not due to negligence; operational systems are inherently complex, and applying a patch hastily could disrupt ongoing processes. An unqualified change near a safety instrumented system may pose additional risks rather than mitigate them. Furthermore, many industrial assets can only receive updates after thorough validation from original equipment manufacturers (OEMs), a process that can stretch over months. Tracking down a suitable maintenance window poses its own challenges: unplanned downtime can lead to financial losses or jeopardize safety.
The reality is that many industrial sectors are still running unsupported products. Hathaway identifies manufacturing and healthcare as particularly vulnerable, where outdated engineering workstations and unpatchable PLC generations exist without update mechanisms. For such industries, the advice to "patch faster" is impractical; upgrading systems often demands years of capital investment and planning. In OT, a patch serves not merely as a fix but as the start of a project.
Shifting Triage Strategies
With the impending influx of vulnerabilities, the traditional prioritization method grounded in the Common Vulnerability Scoring System (CVSS) may soon become obsolete. When AI-driven disclosures flood the market with several high-severity advisories in quick succession, distinguishing which vulnerabilities to address first based on severity will become untenable. Rapid7 has already forewarned that the confluence of rising disclosure volumes and exploit speeds necessitates exposure-based prioritization instead.
Operators should consider a triage method based on three crucial questions: Is there evidence of exploitation? Is the asset exposed to the outside network? What are the consequences of the asset's failure? Utilizing the guidelines laid out in IEC 62443, organizations can define exposure levels and implement compensating countermeasures when timely patching isn't feasible—such as segmentation and enhanced monitoring for potential exploitation.
Preparing for the Surge of Patches
Hathaway urges sector leaders to proactively strategize for the impending surge in patch volume. Several steps should be prioritized. First, engage with OEMs and integrators to understand how they will handle AI-disclosed vulnerabilities, including expected patch volumes and timelines for qualification. The guidance provided by joint entities like CSA, SANS, and OWASP offers a practical checklist for initiating these conversations.
Next, it's essential to negotiate emergency maintenance windows with operations in advance, reliably defining criteria for unplanned downtime in the event of critical vulnerabilities. Conducting preparedness drills for potential simultaneous high-severity disclosures will ensure teams are ready to respond effectively without scrambling. Lastly, for assets that cannot be patched expediently, establish a clear retirement date and budget allocation for eventual upgrades. Compensating controls are a stopgap, not a permanent solution. An unchecked inventory of "unpatchable" assets is merely compounding long-term technical debt.
While policy discussions surrounding disclosure timelines and vendor liability will unfold at governmental levels, operators will ultimately bear the brunt of the resulting decisions. The pace of vulnerability discovery is no longer someone else’s problem; it’s firmly within the operational domain. Acknowledging this and readying the remediation process for the challenges ahead will be a critical determinant of success in operational technology.
