When 24 hours becomes too late: How AI is collapsing the CVE to exploit timeline

A new exploited vulnerability is published every two days. A new exploited zero-day, every three. And in 2026, WithSecure’s threat research predicts the median time from CVE disclosure to active attack will drop below 24 hours.

That is not a future problem. It is today’s operating reality – and reactive security was not built for it.

The old playbook is broken

For years, organisations managed vulnerabilities on a familiar rhythm: monthly patch cycles, Patch Tuesday schedules, periodic audits. That model made sense when attackers needed days or weeks to weaponise a new vulnerability.

AI has changed that equation. Threat actors now use generative AI tools to analyse disclosures, generate working exploits, and launch attacks faster than any human-paced patching process can respond. By the time a critical CVE has been triaged, prioritised, and added to the next maintenance window, exploitation may already be underway.

This is not a tooling gap. It is a mindset problem. Too many organisations – midmarket companies especially – are still operating as though the threat landscape moves at the speed it did five years ago.

Why midmarket organisations are most exposed

Smaller IT teams face a compounding challenge. Unlike large enterprises that have spent years building security infrastructure, midmarket organisations are often left managing an expanding digital attack surface with limited resources, no dedicated SOC, and a growing volume of CVE findings coming in around the clock.

The result: confidence gaps. Organisations assume their existing controls still apply to the most advanced threats. They underestimate their attractiveness as targets. And they remain in reactive mode – responding to incidents that proactive security could have prevented.

CVEs are now competing with compromised identity as the most common initial attack vector. That means exposure management can no longer be an afterthought. It needs to happen continuously, automatically, and ahead of exploitation.

Moving left: from reaction to prevention

Proactive security means closing exposure windows before attackers find them – not after.

WithSecure Elements combines Exposure Management (XM) and Extended Detection and Response (XDR) to do exactly that. Rather than waiting for an incident to trigger a response, the platform continuously reads the threat landscape in real time: surfacing CVEs, flagging misconfigurations, and identifying risky software the moment it appears across the environment.

Crucially, Elements can act before patches even exist. Pre-zero-day vulnerability discovery – a patent-pending capability – uses behavioural telemetry from XDR sensors to detect exploitable vulnerabilities before they have been reported or analysed. When WithSecure identified its first such vulnerability in 2025, the vendor confirmed the fix in their own release notes.

When a new exposure is found, pre-emptive mitigation actions let IT admins respond immediately – isolating devices, resetting credentials, or triggering Outbreak Control to automatically contain high-risk situations – while remediation catches up.

Proactive and reactive, working together

This is not about replacing reactive security. Detection and response still matters. What changes is when and how often it is needed.

When exposure management continuously reduces the attack surface – automatically finding gaps, flagging risky software, and hardening endpoints ahead of known campaigns – fewer incidents reach the stage where reactive response is required. The result is less alert fatigue, faster mean time to detect and respond, and measurable security outcomes that MSPs can demonstrate to customers at every business review.

The 24-hour threshold

When the window from vulnerability to exploitation collapses below 24 hours, waiting is no longer a strategy. Real-time visibility, smart prioritisation, and automated mitigation are the only controls that move fast enough.

Proactive security is not a luxury for well-resourced enterprises. It is the foundation every organisation needs to stay ahead in a threat landscape that no longer waits.