Vulnerability management quietly assumed a buffer between disclosure and exploitation—but that buffer was always the attacker's clock, the time it took to weaponize a flaw, and AI has collapsed it to near zero. The week's seemingly unrelated stories (Ivanti exploited in 24 hours with targets pre-mapped, the Oracle PeopleSoft breach that preceded disclosure entirely, and a federal three-day patch mandate) are one story about a defensive tempo gone obsolete. The sharp move is abandoning severity-based triage—which ranks how bad a flaw could be rather than whether it's already being used—for breach-and-attack simulation, while recognizing that criminal operations now run with enterprise-grade organization and multi-vendor sourcing.

Topics: vulnerability management, AI-accelerated exploitation, zero-day disclosure, breach-and-attack simulation, ransomware-as-a-service