On June 22, 2026, the heads of five national cybersecurity agencies—from the United States, United Kingdom, Canada, Australia, and New Zealand—published a joint statement warning that frontier AI models are expected to fundamentally transform offensive and defensive cyber capabilities within months, not years.
The Five Eyes agencies cited how AI is shrinking the window between vulnerability discovery and exploitation, and this has already proven true. In just the three months following the announcement of Claude Mythos and the latest frontier AI models, there was an exponential increase in vulnerabilities discovered, including in some of the most complex and scrutinized software in existence.
In response to the influx of AI-fueled vulnerabilities, many authorities, including CISA with BOD 26-04, are calling for organizations to patch faster and smarter. The Five Eyes statement also recommended to “accelerate patching processes” as “AI is shortening the time between vulnerability discovery and exploitation.”
But patching has been on thin ice for quite some time, with security teams constantly chasing the patch gap. A 2026 Cloud Security Alliance report found that only 9% of organizations remediate critical or high-severity vulnerabilities in production within 24 hours, while 74% take between one and seven days.
Any delay puts critical systems at risk,and AI has widened the patch gap and made it even more difficult to cross. Keeping pace wasn’t realistic before, now it is not even an option.
If not patching, then what can security teams do? As acknowledged by Anthropic and others, changing the security focus to mitigation versus prevention and remediation is the answer.
Mitigation Is How You Take Back Control
In a write-up on N-day exploits, Anthropic researchers discussed the patch gap and the difficulty defenders face in rolling out updates quickly across products. Their conclusion is that a “more durable fix would attack the supply of bugs, rather than the speed of patching them.” That includes “mitigations that retire whole exploit classes at once.”
Anthropic is onto something. Where patching addresses individual vulnerabilities one by one, mitigation targets the underlying conditions that make vulnerabilities exploitable in the first place. Retire an exploit class, and a whole category of vulnerabilities loses its leverage, regardless of whether a patch has been applied or whether the vulnerability has even been discovered yet.
Runtime exploit prevention is the clearest example. Rather than relying exclusively on pre-deployment defenses, like static analysis or penetration testing, runtime protections operate during execution, blocking common attack patterns such as buffer overflows and Return-Oriented Programming (ROP) attacks before they succeed.
A technique like Load-time Function Randomization, for instance, can prevent an attacker from exploiting a known buffer overflow in a deployed system even when that system has not been patched. The vulnerability still exists. But the attacker cannot weaponize it.
Mitigation is especially important for systems that cannot be updated frequently, like software in OT/ICS environments, medical devices, and defense. In many cases, a patch may never become available. In these instances, organizations need protections that hold up between patch cycles or if a patch never arrives.
Why Mitigation Changes the Defensive Posture
Patching is inherently reactive. When a vulnerability is disclosed, the race to remediate begins. However, AI has amplified the attacker’s advantage by compressing time, and defenders cannot staff or fund their way to a remediation velocity that keeps pace.
That changes the dynamic with attackers in a way that faster remediation does not. Mitigation can be applied before any specific vulnerability is identified, changing the equation by making vulnerabilities non-exploitable, regardless of whether a patch exists.
The Five Eyes statement calls for organizations to “prioritize foundational cybersecurity practices and controls” and to build resilience that “cannot depend on a single solution or technology.” Mitigation belongs in that foundation. An organization that has reduced the exploitability of its deployed software is more resilient than one that simply patches faster.
What Organizations Can Do Now
The place to start is with the software already running in production. Assess which systems carry the most exposure, which face the longest patch timelines, and which handle the most sensitive operations.
For new procurement, look for software suppliers that demonstrate that their products ship with built-in runtime protections, or can have those protections applied without disrupting operations.
Additionally, requiring a build-time Software Bill of Materials (SBOM) for each product makes it possible to assess exposure quickly when a vulnerability is disclosed and to prioritize hardening accordingly.
Finally, while patching is still necessary and should be accelerated where possible, in an environment where AI enables adversaries to move from vulnerability discovery to working exploit in hours, patching alone is not a complete defense.
Automated vulnerability mitigation is the next evolution in how organizations protect deployed software. The ones that get ahead of this will be the ones that reduce exploitability broadly enough that the patch gap stops being the most dangerous variable in their risk equation.
