IT Teams Face 48,000 CVEs as AI Shrinks Exploit Window to 5 Days
Updated
Updated · Computerworld · Oct 21
IT Teams Face 48,000 CVEs as AI Shrinks Exploit Window to 5 Days
1 articles · Updated · Computerworld · Oct 21
Summary
Nearly 48,000 CVEs were published in 2025, and the average time from disclosure to exploitation has fallen to about five days, leaving many IT teams unable to keep pace with traditional monthly patch cycles.
AI is accelerating both discovery and attack: researchers find flaws faster, while attackers can analyze patches, reverse-engineer fixes and weaponize exploits before standard change windows open.
That surge is breaking severity-based patching programs, especially across mixed fleets of endpoints, servers, third-party apps and cloud workloads where hundreds of updates arrive each month.
Risk-based prioritization is emerging as the practical response, focusing first on actively exploited flaws, internet-facing systems and critical assets while automating routine updates through staged deployment rings.
The broader shift redefines success from patching everything to cutting the most meaningful exposure, with asset visibility, ownership and faster IT-security handoffs now as important as patching tools.