The Exploit Window Went Negative. Our Remediation Model Didn't Notice.

Two clocks govern application security, and both just broke.

The attacker's clock has gone negative. Mandiant's M-Trends 2026 report estimates the mean time-to-exploit at roughly negative seven days, meaning that on average, exploitation now begins before a patch exists. Our clock runs the other way. The average time to fix a flaw has stretched from about 171 to 252 days over five years, and half of organizations now carry critical vulnerabilities that have sat open for more than a year.

A 252-day average against a negative exploitation window is not a tuning problem. You do not close that gap with a better dashboard.

For fifteen years, the industry's answer has been smarter triage: risk scoring, exploit prediction, reachability, business context, all in service of deciding which findings deserve a developer's scarce attention. That was rational when fix capacity was the bottleneck. But it is worth being honest about what prioritization is: a rationing mechanism. It exists because we couldn't fix everything, so we built an elaborate apparatus for deciding what to leave broken. A pile of year-old critical flaws is the predictable output of a system optimized to defer.

AI is now reshaping both sides of that equation. It writes more of the code we scan, and it surfaces flaws faster than teams can work through them. It is also starting to change the economics of fixing, not just finding, though a model that proposes a patch has moved the work rather than finished it. Automated remediation only earns volume when three things hold. The fix is computed rather than guessed: the lowest dependency version that clears the CVEs without breaking resolution, or the code change that closes the flaw at its source. It is validated in the real pipeline before a human ever sees it, escalating rather than handing over a broken change. And every finding has an owner and a terminal state, because closure fails on routing more often than on engineering.

Discovery has been solved for a decade. We kept optimizing it because fixing was too expensive to attempt at scale. That constraint is lifting. Teams that see the shift early will spend the next two years clearing a decade of inherited debt. The ones that don't will keep producing exquisitely prioritized lists of things they never got around to fixing.