Mean Time to Exploit Has Gone Negative. Security Strategy Has to Change.

Mandiant's M-Trends 2026 report puts estimated mean time to exploit at negative seven days. That number should reset how security leaders think about vulnerability management. It means exploitation is now routinely occurring before a patch is available.

In 2018, that same window was 63 days. Defenders had roughly two months between disclosure and exploitation to identify, prioritize, test, and deploy a fix. In 2024, the metric crossed zero. Now it sits at negative seven. The window did not just shrink. It inverted.

The question that should follow immediately: how quickly can we find the adversary that is already here?

The Numbers Behind the Collapse

The Mandiant figure is not an outlier. Multiple independent sources have converged on the same conclusion.

Source: Mandiant M-Trends reports 2019-2026.

CrowdStrike’s 2026 Global Threat Report documents a sharp rise in pre-disclosure exploitation, reporting a 42 percent increase in zero-day vulnerabilities exploited before public disclosure. Google's Threat Intelligence Group tracked 90 zero day vulnerabilities exploited in the wild during 2025, with 48 percent targeting enterprise technologies, an all time high. The Verizon 2025 DBIR found vulnerability exploitation now accounts for 20 percent of all breaches, a 34 percent year over year increase.

AI is reducing the skill and time required to turn advisories into working exploit logic. Even when AI does not produce a finished exploit, it accelerates vulnerability comprehension, payload adaptation, and target specific testing. LiteLLM's CVE-2026-42208 was actively exploited within 36 hours of advisory publication earlier this year. On May 1, 2026, Reuters reported that CISA is considering cutting the default KEV remediation window from two weeks to three days in direct response to AI compression of exploitation timelines.

The threat is fast. That is proven. The question now is what that speed means for defensive strategy.

Why Prevention Heavy Budgets No Longer Match the Threat Model

The traditional vulnerability management model assumes a positive gap between disclosure and exploitation. That gap is where patching lives. Identify, prioritize, test, schedule, deploy, verify. That sequence assumes time. When estimated mean time to exploit is negative seven days, the entire sequence executes after the adversary is already inside.

If exploitation can precede patch availability, then patching cannot be the decisive control for that class of vulnerability. It remains necessary, but it cannot be sufficient. The decisive control becomes time to detection. The organization that finds the actor in hours survives. The organization that finds the actor from a ransom note does not.

Organizations spending the majority of their security budget on preventive controls are optimizing for a threat model that expired sometime in 2023. CrowdStrike's 2026 report found 82 percent of detections are now malware free. The fastest observed eCrime breakout time was 27 seconds, with the average at 29 minutes. Mandiant's M-Trends 2026 report found the initial access broker handoff to a ransomware affiliate has collapsed to 22 seconds.

Mandiant’s M-Trends 2026 report found prior compromise was the most frequently confirmed initial infection vector for ransomware in 2025 at 30 percent, double the prior year. Ransomware operators are purchasing footholds that already exist. No patch deployed at the time of the ransomware event would have prevented the initial compromise because it was already in the past.

Prevention still matters. It gets right sized for a threat landscape where it can no longer carry the entire defensive load alone.

Assume Breach and Detection as the Decisive Controls

The security industry has talked about "assume breach" for over a decade. For most of that time it remained aspirational. The data now says something different. Assume breach has become descriptive of the current reality.

Mandiant's M-Trends 2026 report found global median dwell time at 14 days, up from 11 in the prior period. For cyber espionage incidents, median dwell time reaches 122 days. Organizations detected malicious activity internally only 52 percent of the time, up from 43 percent the prior year. For every breach an organization finds on its own, there is roughly another one it only learns about when someone else tells it.

If dwell time is measured in weeks or months and nearly half of compromises are found externally, a significant percentage of organizations are compromised right now and do not know it.

The control that determines business impact is detection speed. The mechanism that compresses dwell time is threat hunting: proactive, hypothesis driven searching for adversary presence that does not wait for an alert to trigger.

The financial case is quantified. IBM’s 2025 Cost of a Data Breach Report found that organizations using security AI and automation extensively saved $1.9 million per breach and reduced breach identification and containment time by 80 days. Organizations with extensive use identified and contained breaches in 204 days, compared with 284 days for organizations with no use. That gap translates directly to reduced blast radius and lower cost.

Mitiga’s 2026 cloud resilience research recommends rebalancing security investment toward 50 percent prevention, 30 percent detection, and 20 percent response. The exact ratio matters less than the direction. The same AI capabilities compressing the offensive timeline are available on the defensive side today. AI assisted threat hunting allows security teams to generate hypotheses at machine speed, correlate anomalies across millions of log entries, and automate triage down to the investigations that warrant human attention.

The SANS 2025 Threat Hunting Survey found that 61 percent of organizations cite skilled staffing shortages as their primary barrier to threat hunting. The investment case includes solving the capacity problem, not just purchasing platforms. Organizations need dedicated headcount, structured methodology, and AI tooling that allows smaller teams to operate at the pace the threat demands.

What Security Leaders Should Do Now

Rebalance investment toward detection and response. Shift budget toward threat hunting teams, behavioral analytics, and incident response readiness.

Stand up or expand threat hunting programs. Weekly structured hunts targeting identity based lateral movement, administrative tool misuse, and edge device compromise. Compromise assessments that start from the assumption the adversary is present.

Deploy AI assisted defensive tooling. Hypothesis generation, log correlation, anomaly detection, and triage automation at machine speed. Organizations that restrict their security teams from AI capabilities do not reduce the offensive use case. They forfeit the defensive one.

Operate under the assumption that prevention has already failed somewhere in the environment. Design detection and response capabilities around that assumption and the dwell time numbers will follow.

The organizations that survive this shift will not be the ones that patch perfectly. No one patches perfectly at negative seven day speed. They will be the ones that assume exposure, hunt continuously, compress dwell time, and use AI to scale defensive judgment before attackers use it to scale exploitation.

The patch window has inverted. Security strategy has to invert with it.

Sources:

• Mandiant, Google Cloud, M-Trends 2026: Data, Insights, and Strategies From the Frontlines, March 2026.
• CrowdStrike, 2026 Global Threat Report, February 2026.
• CrowdStrike, 2026 Global Threat Report Executive Summary, February 2026.
• Google Threat Intelligence Group, Look What You Made Us Patch: 2025 Zero-Days in Review, March 2026.
• Verizon, 2025 Data Breach Investigations Report, April 2025.
• Reuters, U.S. officials weigh cutting deadlines to fix digital flaws amid worries over AI-powered hacking, sources say, May 1, 2026.
• IBM, Cost of a Data Breach Report 2025, 2025.
• IBM / hosted PDF copy, Cost of a Data Breach Report 2025: The AI Oversight Gap, 2025.
• SANS Institute, 2025 Threat Hunting Survey: Advancements in Threat Hunting Amid AI and Cloud Challenges, March 2025.
• Intel 471, SANS 2025 Threat Hunting Survey Report, 2025.
• Mitiga, A Mindset Shift for Cloud Security Resilience: Assume Breach, 2026.