AI is overwhelming patch management. Here’s how teams adapt

AI has changed the patch-management game forever for overworked and understaffed security teams.

Many security pros privately question if they can keep up with today’s AI-generated workload.

“They can’t,” said Jeff Williams, founder and chief technology officer at Contrast Security. “The government is now pressuring them to fix the most serious bugs in three days — and that’s also basically impossible."

John Gallagher, vice president at Viakoo, said the era of the comfortable 30-day, or even 15-day patch cycle is officially dead.

“AI-driven threats have clearly inverted the urgency for security teams from threat detection to threat remediation,” said Gallagher.

Defenders used to think they had days or weeks to patch before widespread exploitation — AI changed all of that.

The truth is nobody can keep up with the patching load right now — and the pace of recent events has been more hectic than ever in the past couple of weeks.

As recently as July 14, Microsoft patched more than 600 bugs in a single release for the July Patch Tuesday — and that was after a record-setting 206 flaws released the previous month.

In a period of just a few days between July 14 to 16, the Cybersecurity and Infrastructure Security Agency (CISA) told federal agencies to patch vulnerabilities in Oracle E-Business and Microsoft SharePoint; Symantec reported that a soup-to-nuts ransomware attack was executed in under 24 hours, a case that underscored the sheer speed of AI-generated hacks.

"The patch gap is very real and AI is making it more expensive by the day,” said Shani Raba, vice president of R&D and security lead at Miggo Security.

Raba said recent research by the Cloud Security Alliance found that only 9% of organizations remediate critical vulnerabilities within 24 hours, and among those that take four to seven days, 97% experienced an incident tied to a known vulnerability.

“When exploits emerge within hours of disclosure, that window is exactly where breaches happen,” said Raba. “One practical way teams are using AI to keep up is mitigation first. An AI-generated virtual patch or application-layer rule, built with awareness of how the application behaves in runtime, can shield a vulnerability in minutes while the mitigation goes through proper testing instead of being rushed to production.”

Waseem Ahmed, head of engineering at Secure.com, said Microsoft has publicly stated that releases will keep getting bigger because AI finds more bugs, faster, across more code.

The teams that are keeping up aren't patching faster, Ahmed said, adding that they already know which of their systems face the internet and which ones matter so when a CVE drops they answer one question in minutes: Do we run this, and can someone reach it from outside? Most teams still spend the first two days just figuring that out, and that’s the part Ahmed said that must be fixed first.

“Volume is noise,” said Ahmed. “What works is a small list, rebuilt every day, of what's reachable and worth attacking — prioritized by CISA's KEV catalog and the exploit prediction scoring system (EPSS) rather than a CVSS number. The national vulnerability database has stopped enriching most CVEs, so CVSS-based triage now misses roughly one-third of what actually gets exploited.”

Who can do 30 days of work in one afternoon?

Alon Noy, co-founder and CEO of Astelia, said now that frontier AI models can turn a CVE into a working exploit in hours, no one can compress a 30-day cycle across thousands of findings into one afternoon.

Noy said teams can keep up by patching far less. Most of what a scanner flags as critical isn't reachable in a given environment, and Noy said only about 1% is genuinely exploitable once we account for the real network topology.

“Racing to patch the rest burns your scarcest resource on vulnerabilities an attacker can't even get to,” said Noy. “Patching also isn't the only option, or the fastest one. When there's no fix yet, or a system can't take downtime, a configuration change, a segmentation rule, or a compensating control can cut the attack path in minutes, and the vulnerability stops being reachable without a patch at all.”

Kevin Surace, chief executive officer at TokenCore, added that defenders can also practice intelligent prioritization. Security teams should combine active exploitation data, internet exposure, asset criticality, privilege level, business impact, threat intelligence, and the availability of compensating controls.

“A vulnerability on an isolated test system should not receive the same priority as the same vulnerability on an exposed identity server or financial application,” said Surace. “Defenders should also deploy AI capabilities that identify vulnerable devices, propose remediation priorities, create deployment groups, test patches in representative environments, monitor for application failures, confirm successful installation, and initiate rollback when necessary.”

It's also important to do automated regression testing, said Surace. Applying a patch quickly doesn’t make sense if the organization then spends several days manually determining whether it broke a critical application. Surace added that AI-generated tests, digital twins, controlled deployments, automated validation, and automated rollback are what turn patch management from a ticketing process into an operational defense system.

Move to continuous remediation

Sagy Kratu, principal cybersecurity strategist at Vicarius, explained that the 30-day patch window belonged to a world where disclosure and exploitation were separated by time. Today, that gap can collapse to hours. Detection moves at machine speed, while remediation still moves at human speed and attackers are operating on the faster clock.

Kratu said his team's research illustrated that imbalance: 74% of organizations say more than half of their remediation workflow runs manually, while only 7% report fully automated remediation. Many teams have automated the alarm, but not the response. AI that simply discovers more vulnerabilities, faster, risks creating a larger and more urgent backlog.

The answer, said Kratu: move from calendar-based patching to event-driven remediation. Teams need a closed loop that can detect, prioritize, act, and verify continuously:

“This does not mean eliminating people,” said Kratu. “It means moving humans from being inside every repetitive step to supervising the system, defining policy, setting risk boundaries and handling exceptions. Make the objective humans-in-the-loop, with AI performing the routine work at the speed the threat environment now demands.”

TokenCore’s Surace said Microsoft recently addressing more than 600 vulnerabilities in a single release makes the patching problem obvious: no human team can manually investigate, test, approve, deploy, and validate that volume fast enough.

“The industry must stop treating faster patching as a staffing problem,” said Surace. “Adding more analysts will not solve a machine-scale challenge. Security teams need automation that can operate continuously and make thousands of low risk decisions without waiting for a person to open a ticket, schedule a meeting, or approve every individual action.”

Cristian Rodriguez, CrowdStrike's Americas Field CTO, added that security teams better get ready, because they will soon face hundreds of new vulnerabilities and multiple zero-days in a single day. Rodriguez said traditional weekly or monthly patching based on CVSS scores can't keep pace anymore.

“Organizations need continuous AI-powered and adversary-informed prioritization that identifies not just what's vulnerable, but what's being actively exploited, by whom, and which exposures matter most,” said Rodriguez. “Bottom line: If we're waiting for an attacker to find our weaknesses before we do, we've already lost. The alarm has gone off. The time to act is now.”