Michael Cembalest’s new J.P. Morgan report, Patchmageddon, describes a fundamental change in cybersecurity.
The time available to defenders is collapsing. The report states that the average period between disclosure of a vulnerability and its first exploitation has fallen to a single day. At the same time, organisations are taking longer to remediate vulnerabilities. In approximately 60 per cent of breaches, a patch was already available when the compromise occurred.
AI will intensify the problem. Frontier models can identify previously unknown vulnerabilities, connect apparently modest weaknesses into serious exploit paths, and help turn disclosed vulnerabilities into working exploits far more rapidly than before.
Patching remains essential. But patching is not instantaneous.
Before a patch can be deployed, an organisation may need to identify every affected asset, update dependent software, test compatibility, obtain operational approval and schedule downtime. Even then, some endpoints may remain unpatched without anyone realising it. The report notes that security teams regularly postpone patches because of the risk of disrupting operations.
The problem is more severe in operational technology and critical infrastructure. Industrial systems may remain operational for 10 to 18 years. J.P. Morgan estimates that only 55 to 65 per cent of industrial network hardware may be patchable, leaving a substantial proportion difficult or impossible to update.
This raises a question that deserves more attention:
