AI Has Made Cyber Exploits Faster Than Patches — 28% of CVEs Now Exploited Within 24 Hours

The Facts

Mandiant's M-Trends 2026 report has documented a threshold crossing that cybersecurity professionals have long warned about: exploits now routinely arrive before patches, with 28.3% of newly disclosed CVEs being actively exploited within 24 hours of public disclosure.

To appreciate how dramatic this shift is, consider the historical baseline. In 2020, the average time-to-exploit — the interval between a vulnerability being publicly disclosed and a working exploit appearing in the wild — was over 700 days. By 2025, that number had compressed to 44 days. By 2026, it has gone negative for more than a quarter of all CVEs, meaning attackers are developing exploits before vendors have time to release and deploy patches.

The scale of malicious code in public repositories tells a parallel story. In 2022, Sonatype counted 55,000 malicious packages in public software repositories. By 2025, that number had grown to 454,600 — an eightfold increase in three years, with notable acceleration in 2023 (when GPT-4 was released) and 2025 (when agentic coding tools became widely accessible).

Perhaps most illustrative of AI's democratisation of offensive capabilities: in February 2025, three teenagers aged 14, 15, and 16 — none with prior coding experience — used ChatGPT to build an attack tool that hit Rakuten Mobile's systems approximately 220,000 times. The full findings are documented in Mandiant's M-Trends 2026 report.

Technical Deep-Dive

The mechanism behind AI-accelerated exploitation follows a clear pattern. Traditional vulnerability exploitation required an attacker to understand the affected codebase, identify the exact memory or logic conditions that trigger the vulnerability, write a proof-of-concept exploit in C or assembly, test it against target environments, and weaponise it into a deployable payload. That pipeline took months of specialised skill.

Large language models, particularly agentic coding systems like Claude Code and GitHub Copilot, can compress each of these stages. Given a CVE disclosure with a description of the affected component and the vulnerability class, a current frontier model can generate a plausible proof-of-concept exploit in minutes. That PoC may require refinement, but the entry barrier for the attacker has fallen from "skilled reverse engineer" to "person who can describe what they want in plain English."

Meanwhile, the average time to remediate a known critical CVE remains 74 days — a gap that has barely moved despite years of investment in patch management tooling. Defenders are patching at human speed. Attackers are exploiting at machine speed.

The ASEAN Perspective

For organisations in Singapore, Malaysia, Indonesia, and the Philippines, the Mandiant data translates into concrete risk exposure. ASEAN enterprises are disproportionately reliant on open-source software and public cloud infrastructure — both of which depend on the same public repositories where malicious package counts grew from 55,000 to 454,600 in three years.

Singapore's Cybersecurity Agency has expanded its oversight to new entity categories under the Cybersecurity (Amendment) Bill, recognising that the threat surface has expanded beyond traditional Critical Information Infrastructure. The 74-day average remediation window is an area where ASEAN enterprises can make immediate impact: reducing that window through automated patch deployment and continuous vulnerability scanning is one of the few defensive measures that directly counters the shrinking time-to-exploit window.

Black Hat Asia returned to Marina Bay Sands in Singapore in April 2026, with AI-assisted attacks as a primary theme — reflecting how central this issue has become to the regional security community.

RECATOOLS Verdict

The 28.3% within-24-hours figure should be a forcing function for every organisation still operating on monthly patch cycles. The arithmetic is clear: if more than one in four exploits arrives before the patch, then patch speed alone cannot be the primary defence.

The practical implication is a shift toward architecture that assumes compromise — zero-trust network segmentation, behavioural detection rather than signature-based scanning, and rapid isolation capabilities when incidents occur. Patching remains essential, but it can no longer be the last line of defence.

For ASEAN organisations operating with lean security teams, automated vulnerability scanning tied to public CVE feeds — with immediate alerting on newly disclosed vulnerabilities in your stack — is now a baseline requirement, not an advanced capability.

Frequently Asked Questions