Patching Takes Weeks, Exploits Take Hours

Asaf Ezra and Steph Zhang argue in a16z Blog that defense must assume slow patches, citing PHP servers attacked four days before disclosure and a Linux kernel bug turned into a remote exploit without login in under an hour.

Exploits now take hours. Fixes still take weeks.

The 2026 Verizon breach report put median full remediation at 43 days and found only 26% of known-exploited vulnerabilities fully remediated in its dataset, a pace the authors contrast with exploit generation in hours.

That gap looks worse off the cloud. Between 2.6 and 4.4 million PHP installations sat outside the edge protections that blocked early attacks, according to the piece, most on versions that will never receive a fix.

The live-fix pitch already has a shipping example. Impart Security launched a Runtime Defense Harness where AI agents write and test virtual patches in a controlled setting without putting AI in the traffic path, with blocking decisions approved by an engineer, per Help Net Security. The harness works with models from Anthropic, OpenAI, Azure or Google, which makes the call for auto-generated network rules less theory and more product race.

Victims whose backups were compromised reported median recovery costs of about $3 million, against $375,000 where backups survived, according to Sophos data cited by the authors. Those medians compare different incidents, not the same attack with and without intact backups, so they do not show what protection alone would save.

Published rates for false blocks and automatic rollbacks would change the read, because speed without safety repeats the outage problem. If shelter must come from someone else, who pays for the water plant and the clinic that cannot pay, and whose rules decide what gets blocked?