- AI did not break patching. No organization was ever fully patched; AI only makes the treadmill go faster.
- A vulnerability does not lead to a breach on its own. It becomes one when it is reachable, over-privileged, free to move and unwatched.
- Patching is detect and respond. Against attackers at machine speed, flip to Prevent and Adapt.
- The five steps of Zero Trust break the chain, and your Protect Surfaces tell you where patching fast actually matters.
There is a lot of fuss going on right now about how fast AI is moving. Machine speed seems to be the new FUD to describe how attackers move and get better tools. They are not only able to find and weaponize vulnerabilities faster, the time to exploitation keeps shrinking. All this is true. The conclusion we seem to draw from it is not: that we can no longer patch fast enough and that this is a new crisis.
That conclusion is not new, because we were never patching fast enough.
I have visited a lot of different organizations during my career and I dare to state that not one organization had everything patched and current. Not one. Despite capable teams, budgets and good intent, there would (and will) always be a backlog. This is not criticism. It is simply what happens when you need to patch at scale, and the larger and more diverse the organization, the harder it gets. It is basically a treadmill that never stops.
Signal
AI did not break patching, it just made it more obvious that this is something we cannot sustain. It is the treadmill going faster and faster.
Speed is not what needs to change
The instinct is that we should move faster as well, to keep up with the treadmill by patching quicker. But it is a race we were already losing, and if it was not clear before, it should be obvious now that we have lost it.
More importantly, it is a race that does not address why an unpatched system becomes an incident. A vulnerability in itself will not lead to a breach. It turns into a breach once it is reachable, when the accounts operating the machine have more privileges than required, when the host can move freely around the network, and when nobody is watching. Patching only fixes that specific vulnerability, while every other step in this chain is left unattended. This is why patching was never the problem either.
Prevent and Adapt instead of Detect and Respond
Although patching is often seen as a preventive control, it is reactive. It is detect and respond: we scan for vulnerabilities to detect them, and once detected we respond by patching them. If we want to protect ourselves against AI-driven attacks moving at machine speed, we should flip the coin and focus on Prevent and Adapt instead. Prevent first, and adapt when something gets through. Eventually this leads to resilience.
Luckily, this prevention, and what we need to do to break the chain, is nothing new. It all comes back to basic cybersecurity hygiene, and a good way to get there is by implementing Zero Trust as a strategy. Walking through the five steps of Zero Trust guides you to where you need to put your focus.
Step 1
Define your Protect Surfaces. This helps you create a good inventory of what you have and what you need to protect.
Step 2
Map your transaction flows. This maps the expected flows and makes it easier to segment and to detect abnormal behavior.
Step 3
Architect a Zero Trust environment. This is where you implement security controls, such as proper identity and access management.
Step 4
Create a Zero Trust policy. Make sure systems are only reachable for the people or systems that really need access, and maybe do not put that vulnerable system completely open to the internet.
Step 5
Monitor and maintain. Monitor closely so that, if something goes wrong, you can not only react quickly but also adapt, because the controls are in place.
Patch where it matters
To close it off: patching is still important, especially for the systems that are open to the internet and reachable by these AI systems moving at machine speed. With your Protect Surfaces defined, you know where you need to patch fast and where it can wait. You also know the limited impact, the blast radius, if you are too late.
Final signal
Stop running on the treadmill and stop trying to win a race where the pace only increases. Get off and move your focus to prevention. You only need short sprints for the systems where it actually matters. AI is not changing how we should protect ourselves, but it is increasing the need for us to protect ourselves.
Get in touch
Need help getting started?
Reach out to me directly to discuss where your Protect Surfaces are, which systems need short patch sprints, and how to shift from detect and respond to Prevent and Adapt.
Reach outFAQ
Did AI break patching?
No. No organization was ever fully patched and current; there has always been a backlog, especially at scale. AI makes attackers find and exploit vulnerabilities faster, which only makes it more obvious that racing to patch everything cannot be sustained.
When does a vulnerability become a breach?
A vulnerability on its own does not lead to a breach. It becomes one when the system is reachable, when the accounts operating it have more privileges than required, when the host can move freely through the network, and when nobody is watching. Patching only fixes the vulnerability; the rest of that chain needs other controls.
What does Prevent and Adapt mean?
Patching is a form of detect and respond: you scan for vulnerabilities and respond by patching them. Prevent and Adapt flips that around. You prevent first by breaking the chain from vulnerability to breach, and adapt when something gets through. That leads to resilience.
Where should you still patch fast?
On systems that are open to the internet and reachable by attackers moving at machine speed. Defining your Protect Surfaces tells you where you need to patch fast, where it can wait, and what the blast radius will be if you are too late.
Rob Maas is Field CTO at ON2IT, part of the CTO Office under CTO Lieuwe Jan Koning. He works on product strategy and architecture for AUXO, MDR, and ZTaaS, shaping ON2IT's Zero Trust customer journey and AI feature roadmap. He is also a Palo Alto Networks Cyberforce Hero.