CERT-In Orders 12-Hour Patching Window as AI Shrinks Exploit Timelines to Hours

India's national cybersecurity agency has told organisations running internet-facing systems to patch, mitigate, or isolate known-exploited critical vulnerabilities within 12 hours. The 38-page CERT-In blueprint, released 26 May 2026, argues that AI tooling has compressed the average CVE-to-exploit window from roughly 56 days to as few as 10 hours — rendering traditional monthly patch cycles functionally obsolete.