The Patch Window Just Went Negative

When mean time to exploit (the time between a flaw's discovery and its first weaponized attack) goes negative, the patch is no longer the defender's first move. Containment is.

That is the structural shift documented in Mandiant M-Trends 2026. The annual threat-intelligence report puts mean time to exploit at roughly negative seven days, meaning attackers are striking before a vendor patch is even available. The metric used to measure how long defenders had to react. Now it measures how far behind they start.

The 2026 figure is not an isolated reading. InformationWeek's reporting on the multi-layer defense push cites IBM's X-Force Threat Intelligence Index 2026, which put attacks against public-facing applications up 44% year-over-year, and quotes the Cloud Security Alliance's warning of an emerging "AI vulnerability storm" compressing the entire flaw-to-exploit cycle. Both signals are reported through the same vendor-aligned pickup, so security leaders should weight them against the underlying IBM X-Force 2026 index and CSA publications before treating them as operating baselines.

The compression is being driven, in part, by the same frontier AI models that defenders are now adopting. Broadcom's newsroom reports that the company's own testing of frontier AI security models, built in-house and run against Broadcom's own code, accelerated vulnerability discovery by roughly an order of magnitude. The number is striking, but the source basis matters: this is a vendor benchmarking its own code with its own tooling. Independent replication is not on the table in the public record, and security teams should price that in.

What does the shift change in practice? The old operating model was simple: a CVE (Common Vulnerabilities and Exposures identifier) drops, a vendor ships a patch, defenders prioritize and deploy. Each step took days or weeks, and most enterprises ran weeks behind on critical flaws without losing the asset. That gap was the patch window, and it was the central design assumption of enterprise security.

The patch window is the assumption that is breaking. With mean time to exploit at negative seven days, the gap between disclosure and exploitation is shorter than the time it takes most organizations to test, schedule, and deploy a patch, let alone to do so across thousands of endpoints and dozens of legacy applications. Defenders can no longer assume they will have the patch in hand when the first probe arrives.

That is the problem virtual patching and multi-layer defense are trying to absorb.

A virtual patch is a temporary rule, most often a web application firewall signature, an intrusion-prevention system block, or a network-layer filter, that blocks exploit attempts against a known flaw before a permanent code fix can be deployed. It does not actually fix the code. It buys time, and in the current environment that time is the most valuable commodity a security team has. Multi-layer defense extends the same logic across the network: separate controls at the perimeter (north-south traffic, between users and the data center), inside the data center (east-west, between servers), and at the application layer, so no single missing patch becomes a single point of failure.

InformationWeek's coverage frames this as a critical adaptation and points to VMware vDefend, Broadcom's network-detection-and-response plus WAF stack, as one implementation. The product detail is real, but it is also the easy place for the conversation to stall. vDefend, like any other vendor's answer, is a specific choice of WAF, IPS, and orchestration. The underlying mechanism, buying time with compensating controls while the real fix ships, is broader than any one stack.

The harder and more useful work for a security leader right now is putting sharp questions to any vendor pitching the fix. Ask whether the "order of magnitude" acceleration in their testing is reproduced in independent benchmarks, or only in their own. Ask whether their virtual patching covers east-west traffic inside the data center, or only the perimeter. Ask how long it takes, once the WAF or IPS rule goes in front of a new CVE, to show that it actually blocks the exploit, and how drift is measured over time. Ask which compensating controls remain after the permanent patch lands, and which get torn down. And ask, finally, what their detection story is for flaws that no vendor has yet assigned a CVE to.

The last question matters most. The Mandiant M-Trends 2026 number measures what happens after a flaw is known. The executive edition of the report is explicit that AI-assisted discovery is moving the timeline earlier in the cycle, into the gap before a CVE is filed at all. Virtual patching only works once a flaw has a signature. The harder problem is the flaw no one has named yet.

Security teams are not waiting for a clean answer. They are absorbing the asymmetry with compensating controls, tighter segmentation, and a renewed tolerance for stopgap fixes. The patch still ships. It just no longer arrives first.