The 2026 Verizon Data Breach Investigations Report revealed that 31 percent of data breaches today are executed via vulnerability exploitation.

This means the vector has overtaken credential abuse and is now the most common method threat actors utilise to launch attacks.

The report also revealed a severe patching capacity crisis, with the median time-to-patch increasing to 43 days, which was up from 32 days in 2025. The report delivered a stark warning to organisations: vulnerability exploitation was up and organisations needed to tighten their remediation windows before it was too late.

However, even Verizon couldn’t predict just how serious the consequences of this would be for organisations.

The Verizon report studied incidents that took place between November 1, 2024, and October 31, 2025, well before the world had ever heard of Mythos or Project Glasswing. Verizon therefore had no way to predict what organisations were about to face, or how rapidly their existing patching challenges would be amplified.

The emergence of Mythos

When Mythos was announced publicly in April this year, it was met with awe, skepticism and fear. Some experts were amazed such a capable AI platform had evolved from concept to reality, others felt the claims were over hyped, while others believed Mythos had the ability to shatter the defences of organisations across the world.

However, everyone agreed that the vulnerability exploitation and remediation landscape had changed forever.

With Mythos, and other advanced AI platforms that have since been released, being capable of discovering thousands of vulnerabilities in minutes, patching challenges are now being amplified in ways few organisations are prepared for.

Mythos and patch cycles

While attackers themselves don’t have direct access to the most advanced platforms from the major AI players, the public release of vulnerabilities still offers them significant opportunities.

As soon as a vendor publicly announces a vulnerability, attackers will know they still have a window of opportunity to exploit it, especially given the long gaps before patches are generally applied.

From a business perspective, this presents a major concern. With advanced AI platforms discovering thousands of vulnerabilities in minutes, there are concerns attackers will have endless opportunities to break into networks, with some believing the only solution is to evolve from Patch Tuesday to Patch Every Day.

However, while these concerns are all very valid, any organisation that attempts to patch everything immediately will soon overstretch their security teams and will ultimately risk lowering their defences overall.

So, how can organisations respond effectively to advanced AI platforms that are accelerating vulnerability discovery and shrinking exploit windows?

Risk prioritisation

What organisations must understand is that just because a vulnerability has been disclosed, this does not automatically mean it poses the same level of risk to every environment.

Even in tests, Mythos has to chain together attack paths, demonstrating that the existence of a vulnerability alone does not automatically make it exploitable in every environment. Furthermore, context is always essential in vulnerability management, which means organisations should take a risk-based approach to remediation where they prioritise patching based on the risks a vulnerability poses to their own infrastructure, rather than basing remediation efforts purely on generic CVSS scoring.

This means knowing the digital estate, understanding every asset and having an up-to-date inventory of everything that is critical.

This is something that must be done in advance of vulnerabilities being disclosed, because every minute an organisation wastes before applying a critical patch delivers a window of opportunity for attackers.

However, given the volume of vulnerabilities organisations are likely to face, this means manual remediation may be too slow and too resource intensive. Organisations should therefore look for platforms that can support autonomous patching, while also helping them identify the vulnerabilities that put them most at risk based on their unique environment, rather than relying solely on CVSS scores.

As a further layer of security, organisations should also bolster their patching efforts with detection and response, helping them ensure that even if a patch is missed and applied late, any malicious access is identified quickly, before an attacker has the ability to launch a full-scale attack.

Most security teams already carry a backlog of known, unresolved exposures because vulnerability volume has long outpaced remediation capacity. However, advanced AI will only widen this gap even further.

The answer is not to try to patch everything faster, but to become far more effective at identifying which vulnerabilities pose a genuine risk, prioritising them using the context of the organisation’s own environment, and safely automating remediation.

As exploit windows continue to shrink, organisations must understand what matters most and act quickly to remove the risks that pose the greatest threat.