Here is the bottom line up front: the comfortable 30-day patch window most of us grew up with is gone. According to the CrowdStrike 2026 Threat Hunting Report, 88% of the vulnerability exploitation the firm observed in the first half of 2026 happened within 48 hours of public proof-of-concept code being released. AI-enabled threat activity climbed 89% year over year. Attackers are now weaponizing a disclosure almost as fast as you can read the advisory. If your patch cadence is measured in weeks, you are already behind.
A quick honesty note: I have not run CrowdStrike’s Falcon platform myself. What follows is my read of their published research plus the operational judgment I use running IT infrastructure day to day.
What CrowdStrike Actually Found
The headline number is the speed. CrowdStrike reports that 88% of exploitation tied to a public proof-of-concept (PoC) occurred inside a 48-hour window, and some crews moved even faster. China-linked groups the firm tracks as Genesis Panda and Vault Panda launched attacks within 24 hours of disclosure, per CyberScoop’s coverage. That is not a patch window. That is a footrace, and the attacker got a head start.
AI is doing the heavy lifting on both sides of the fence. The report frames AI as “both the weapon and the target,” in the words of CrowdStrike’s Adam Meyers, quoted by The Register. Adversaries are using AI to turn a raw PoC into a working exploit in hours instead of days. They are also attacking AI itself: CrowdStrike says attackers injected malicious prompts into generative-AI tools at more than 90 organizations, and North Korea-linked actors poisoned 131 trusted AI framework packages. Cloud-focused eCrime jumped 171%.
Put plainly: the same automation that helps your team is helping the other team industrialize the boring parts of an attack. Reading advisories, writing exploit code, spraying credentials. That used to take skill and time. Now it takes a prompt.
If your patch cadence is measured in weeks, the attacker already finished the race before you laced up.
Why This Hits Small Businesses and Enterprises Differently
Enterprises have the tooling but not always the tempo. If you run a security team, you probably already have vulnerability scanning, an EDR, and a patch pipeline. The problem is not visibility. It is the gap between “we know about this CVE” and “it is actually patched in production.” A 48-hour weaponization window means your change-approval process, your maintenance windows, and your “we’ll get to it next sprint” backlog are now attack surface.
Small businesses have the tempo but not the tooling. A 12-person company can push an update fast because there is no committee. But most small shops do not know a critical vulnerability exists until something breaks, and they are leaning on default settings and unpatched plugins. I have written before about why AI-generated attacks have quietly become the defining SMB threat of the year in my roundup of AI security tools worth paying for. This report is the same story with a stopwatch attached.
What To Actually Do About It
Do not panic. Panic buys nothing. Prioritize instead. Here is where I would spend my next two weeks.
1. Shrink your critical-patch clock to hours, not weeks. You cannot patch everything in 48 hours, and you should not try. Pick your internet-facing systems, your remote-access gateways, and anything with a known PoC, and commit to an emergency patch lane that bypasses the normal queue. Everything else can stay on the regular cadence.
2. Prioritize by exploitation, not by CVSS score alone. Use CISA’s Known Exploited Vulnerabilities catalog and your vendor’s “actively exploited” flags. A medium-severity bug being exploited in the wild is more urgent than a critical one that nobody has weaponized. This is exactly the pileup I described when I wrote about 2026 tracking toward 66,000 CVEs — you win by choosing the right fights, not by fighting all of them.
3. Reduce your exposure so patching matters less. Every service you take off the public internet is one you no longer have to patch in a panic. Put a VPN or zero-trust gateway in front of admin interfaces. Turn off what you are not using. The cheapest vulnerability to manage is the one an attacker cannot reach.
4. Point AI back at the problem. The defenders’ side of this is real too. AI-assisted triage can tell you which of last night’s 40 advisories actually touch your stack. If attackers get to automate, so do you.
My Take
The 30-day patch window is a relic, and honestly it has been on life support for a while. What is new is the certainty. When 88% of PoC-based attacks land inside two days, “we patch monthly” is no longer a policy. It is a bet you will lose. But this is manageable. The companies that come out fine will not be the ones with the biggest budgets. They will be the ones that decided ahead of time what gets patched in hours, what waits, and who has the authority to push the button at 2 a.m. without a meeting.
The one thing to do this week: write down your emergency patch lane for internet-facing systems, name the person who owns it, and set the target at 48 hours. Then run one drill against it. If you cannot beat the clock in a calm week, you will not beat it during an incident.
News commentary by Brad Rowland — IT Infrastructure and Operations leader, automation builder, and AI implementer. Sources are linked inline.
