# Patching Takes Weeks, Exploits Take Hours

_a16z argues defense must assume slow patches, as exploits drop to hours while remediation still takes weeks._

**Published:** 2026-11-07
**Source:** https://www.startuphub.ai/ai-news/investors-news/2026/patching-takes-weeks-exploits-take-hours

---

Asaf Ezra and Steph Zhang argue in [a16z Blog](https://www.a16z.news/p/defense-in-depth-rebuilt-for-machine) that defense must assume slow patches, citing PHP servers attacked four days before disclosure and a Linux kernel bug turned into a remote exploit without login in under an hour.

Exploits Now HoursDriverFrom the article 2 mentionsAsaf Ezra and Steph Zhang argue in a16z Blog that defense must assume slow patches, citing PHP servers attacked four days before disclosure and a Linux kernel bug turned into a remote exploit without login in under an hour.Live Virtual PatchingOutcomephp attacks blocked four days before disclosure via edge protectionsvsPatches Still WeeksDrivermedian full remediation 43 days per 2026 verizon breach reportcreatesGap Leaves Millions ExposedEffect2.6 to 4.4 million php installs outside edge protections unpatchedneedsRuntime Defense HarnessCoreFrom the articleImpart Security launched a Runtime Defense Harness where AI agents write and test virtual patches in a controlled setting without putting AI in the traffic path, with blocking decisions approved by an engineer, per Help Net Security.Exploits Now HoursDriverFrom the article 2 mentionsAsaf Ezra and Steph Zhang argue in a16z Blog that defense must assume slow patches, citing PHP servers attacked four days before disclosure and a Linux kernel bug turned into a remote exploit without login in under an hour.vsPatches Still WeeksDrivermedian full remediation 43 days per 2026 verizon breach reportleavesMost Vulns UnfixedOutcomeonly 26 percent of known exploited vulnerabilities fully remediated in datasetwidensGap Leaves Millions ExposedEffect2.6 to 4.4 million php installs outside edge protections unpatchedneedsRuntime Defense HarnessCoreFrom the articleImpart Security launched a Runtime Defense Harness where AI agents write and test virtual patches in a controlled setting without putting AI in the traffic path, with blocking decisions approved by an engineer, per Help Net Security.viaHuman Approved BlockingContextFrom the articleImpart Security launched a Runtime Defense Harness where AI agents write and test virtual patches in a controlled setting without putting AI in the traffic path, with blocking decisions approved by an engineer, per Help Net Security.enablesLive Virtual PatchingOutcomephp attacks blocked four days before disclosure via edge protections

Exploits now take hours. Fixes still take weeks.

The 2026 Verizon breach report put median full remediation at 43 days and found only 26% of known-exploited vulnerabilities fully remediated in its dataset, a pace the authors contrast with exploit generation in hours.

That gap looks worse off the cloud. Between 2.6 and 4.4 million PHP installations sat outside the edge protections that blocked early attacks, according to the piece, most on versions that will never receive a fix.

The live-fix pitch already has a shipping example. Impart Security launched a Runtime Defense Harness where AI agents write and test virtual patches in a controlled setting without putting AI in the traffic path, with blocking decisions approved by an engineer, per Help Net Security. The harness works with models from Anthropic, [OpenAI](https://www.startuphub.ai/startups/openai), Azure or Google, which makes the call for auto-generated network rules less theory and more product race.

Victims whose backups were compromised reported median recovery costs of about $3 million, against $375,000 where backups survived, according to Sophos data cited by the authors. Those medians compare different incidents, not the same attack with and without intact backups, so they do not show what protection alone would save.

Published rates for false blocks and automatic rollbacks would change the read, because speed without safety repeats the outage problem. If shelter must come from someone else, who pays for the water plant and the clinic that cannot pay, and whose rules decide what gets blocked?

---

Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.

© StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.