Defense in Depth, Rebuilt for Machine Speed: Why Patching Can't Keep Up

Asaf Ezra argues that AI has made exploits cheap and fast while patching still takes weeks to years, so the gap between exploit and patch will not close by patching harder. He cites the October PHP bugs that were exploited four days before disclosure and an Anthropic report of an unreleased model producing a Linux kernel exploit in under an hour, then ranks four off-device defenses by reach: removing exposure from the open internet, segmentation, network-level virtual patching and eliminating bug classes. He also argues backups are now a primary target, citing Sophos data that 94% of ransomware victims said attackers tried to compromise their backups and 57% of those attempts succeeded.