COMMENTARY: A critical vulnerability disclosed on Monday can become an operational problem before week’s end. AI has collapsed the time between disclosure and exploitation, outpacing the 15-day and 30-day models used across government and industry.The challenge now: shift risk operations to match the speed of the threat.Traditional vulnerability programs move through a familiar sequence of detection, prioritization, testing, approval, remediation and verification. Across government and industry, those workflows often span multiple teams and were designed for an environment where defenders had more time between disclosure and exploitation.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]AI has collapsed that margin. Frontier models can accelerate vulnerability research, exploit development, reconnaissance, and attack-path construction, making the real risk clock begin the moment an exposure becomes actionable against a reachable system. Agencies, contractors and technology providers may operate on different internal schedules, but attackers are forcing all of them onto an accelerated threat timeline.Faster risk reduction requires improved context CISA's BOD 26-04 reflects that shift. Rather than relying on blanket remediation schedules, the directive pushes agencies to account for factors such as internet exposure, KEV status, exploitability and the impact of compromise. For the highest-risk exposures, agencies face remediation timelines measured in days rather than weeks.The directive is relevant beyond government agencies.Government contractors, cloud providers and software companies serving the public sector need similar risk-based prioritization because agency exposure increasingly depends on systems operated outside agency boundaries. A vulnerability in a managed service, SaaS environment, identity provider or widely-deployed enterprise application can become government risk without sitting on a government-owned server.An internet-exposed vulnerability with credible exploitation activity, high privileges, and access to critical internal services or data deserves a different response from an isolated vulnerability with limited reachability and effective compensating controls.Severity starts the conversation, while context determines the responseUnfortunately, many vulnerability programs still operate through disconnected handoffs across security, infrastructure, vendors and change control processes. Each step adds latency and complexity, while the teams involved may work from different asset, threat, and risk perspectives.A Risk Operations Center model, or ROC, replaces those handoffs and bifurcated perspectives with a continuous risk evaluation loop connecting threat intelligence, asset context, remediation and validation outcomes. The ROC model gives agencies and their vendors a common operating picture so priorities can change as quickly as the threat does.Where remediation and incident response converge BOD 26-04 recognizes that forensic triage for certain high-risk vulnerabilities matters. Before declaring a system safe because the vulnerability was addressed, it’s important to determine whether an attacker abused the exposure or has been lying in wait; with eyes on the optimal time to take action.Risk operations teams should apply the same principle to their highest-priority exposures.A successful patch does not remove attacker persistence established yesterday. A configuration change does not revoke credentials already stolen. A compensating control does not undo lateral movement that has already happened.For vulnerabilities that are exposed, actively exploited or capable of giving an attacker substantial control, remediation and compromise assessment need to operate in parallel.The ROC model connects exposure management with incident response and asks whether the organization has actually reduced operational risk, not simply completed a technical task.With these insights in mind, here are five changes government and industry should make now:
Frontier AI models like Mythos exposed the limits of static vulnerability management. Government agencies and technology providers should prioritize risk operation models that connect threat activity, asset context, remediation and validation so they can act on the risks that matter before the attackers do.Nathan Smolenski, chief information security officer, QualysSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
- Replace blanket remediation windows with risk tiers. Establish response windows based on active exploitation, internet reachability, automation potential, asset criticality and post-exploitation impact. Keep longer timelines for lower-risk exposures rather than using 15- and 30-day schedules as universal defaults.
- Build a continuous risk operations function. Connect vulnerability management, threat intelligence, asset inventory, incident response and infrastructure operations through a ROC context model. Risk prioritization should change as conditions change, not only when a new scan or review occurs.
- Create a shared rapid-response lane. Rapid response risk operations require automated testing, so shrinking patch windows from weeks to days does not break critical software or downstream operations.
- Pair high-risk remediation with compromise assessment. When exploitation becomes active or likely, determine whether attackers reached the system before risk reduction occurred. Remediation and forensic analysis should run together when exposure warrants it.
- Measure verified risk reduction. Stop treating ticket closure or patch deployment as the finish line. The ROC model should measure how long meaningful exposure remained open, whether the attack path was actually closed and whether residual risk remains.
