Cybersecurity teams are facing a daunting challenge in the form of a “patch gap,” where attackers are increasingly exploiting vulnerabilities before patches are even available, leaving defenders scrambling to keep up. This issue is not just about patching faster or prioritizing high-severity vulnerabilities, but rather about fundamentally changing how we approach vulnerability management.
The recent announcement by Anthropic of Project Glasswing has highlighted the scale of the problem. The AI-frontier model, Claude Mythos, identified thousands of high-severity vulnerabilities in major operating systems and web browsers, many of which had survived for decades without being fully patched. This is not a patch management issue, but rather a “patch physics” problem – we simply can’t match machine-speed discovery with a remediation cycle that runs on human time.
The numbers are staggering. In 2025, 46,407 CVEs were published, up from 40,009 in 2024, a 16% year-over-year increase. The National Institute of Standards and Technology enriched nearly 42,000 CVEs in 2025, 45% more than any prior year. But even with this increased focus on vulnerability reporting, the exploitation window is shrinking at an alarming rate. In 2018, it took attackers an average of 771 days to exploit a vulnerability after it was disclosed; by 2024, that number had dropped to just four hours.
This “patch gap” is not just about numbers – it’s about how we approach vulnerability management. Traditional methods focus on sorting vulnerabilities by CVSS score and patching the highest-severity ones first. But this approach has several flaws. CVSS scores measure the maximum impact against an abstract target, rather than taking into account the actual risk posed to a specific organization. Furthermore, using CVSS alone can lead organizations to deprioritize vulnerabilities that attackers are actually exploiting.
The problem is structural – we’re thinking in terms of checklists and patching 9s and 10s, rather than considering the connected path from an attacker’s foothold to our most critical assets. This is where graph-based path modeling comes in – a new approach that incorporates attack path aggregation and asset interdependencies to provide risk assessments and calculate risk scores for assets with multiple vulnerabilities.
Graph-based models represent the environment as a directed graph, where nodes correspond to assets and system states, and edges represent exploitable transitions between them. An attacker moving from initial access to the domain controller to the crown jewel traverses a path through that graph. By thinking in this way, security teams can identify the most critical vulnerabilities and prioritize patching accordingly.
The reframe is simple: we need to stop thinking about individual vulnerabilities as isolated items on a checklist, and instead consider how they fit into the larger attack chain. This requires a fundamental shift in our approach to vulnerability management – one that prioritizes understanding the connected risk landscape over simply patching faster or scoring harder. By doing so, we can finally close the “patch gap” and keep pace with the speed of attackers.
Source: Dark Reading — 2026-08-10