"If attackers are finding vulnerabilities faster with AI, can our update and patching processes keep up with that pace?" This question is now on the agenda not only of IT teams but also of risk committees and boards of directors.
The question rests on a recent finding. In Gartner's quarterly emerging-risks survey, published on 25 August 2026, AI-driven cyber vulnerability discovery stood out as the top emerging risk facing organizations in the second quarter of 2026. The survey was conducted in April and May 2026 with 316 senior executives and risk managers from different sectors and regions.
In this article we look at what the risk tells us, how public authorities are reorganizing patch prioritization, and what steps organizations can take to speed up patch management. What to do after a breach has occurred is a separate subject, which we covered in our article on cyber breach and incident response. The focus here is how quickly a vulnerability is closed before a breach occurs.
What does the risk tell us?
According to Gartner's assessment, AI makes vulnerability discovery both more efficient and more accessible, which makes it harder for traditional risk management approaches to keep pace. The assessment notes that if governance, security operations and remediation capacity do not develop in parallel, AI-assisted vulnerability discovery could outpace organizational defenses.
Gartner recommends four ways for organizations to update their assumptions about this risk:
- Recalibrating risk impact assessments to reflect the growing exposure,
- Updating risk appetite to reflect the continuous nature of vulnerability discovery,
- Strengthening third-party controls so that suppliers do not introduce new risk,
- Accelerating cyber response strategies for faster patching and automated remediation.
We covered the contractual and notification side of supplier relationships in our article on supplier-originated data breaches. This article focuses on the fourth item, that is, the speed of patching.
How are public authorities reorganizing patch priorities?
On 10 June 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) published BOD 26-04, a binding directive for federal agencies. The directive's rationale stresses that attackers' use of AI could narrow even further the response time between the release of a patch and its exploitation. By revoking two earlier directives (BOD 19-02 and BOD 22-01), it consolidates them into a single risk-based framework.
The directive binds only US federal agencies; it creates no obligation for Turkish companies. Its prioritization logic, however, offers a clear model that any organization can adapt to its own process. How urgently a vulnerability must be closed is determined by four questions:
- Is the asset exposed to the internet?
- Is the vulnerability in CISA's "Known Exploited Vulnerabilities" (KEV) catalog?
- Can the attacker automate every step of the exploit?
- After exploitation, does the attacker gain partial or full control of the system?
Depending on the answers, the deadlines diverge markedly. For a vulnerability that is exposed to the internet, listed in the catalog and gives full control, the deadline is 3 calendar days; in addition, a preliminary forensic examination is required to determine whether the system has been compromised. At the other end of the spectrum, vulnerabilities that are not exposed to the internet, not in the catalog and not automatable can be remediated at the next scheduled major update. In between are tiers of 14 and 60 days.
The observation behind this approach was already present on the BOD 22-01 page that CISA published in 2021. According to the analysis at the time, fewer than 4% of all vulnerabilities assigned a CVE ID had been publicly exploited; however, 42% of those that were exploited were used on the day of disclosure, 50% within two days and 75% within 28 days. In short, instead of trying to close every vulnerability with the same urgency, organizations need to close the ones that are actually exploited very quickly.
The legal framework in Türkiye
Article 7 of Cybersecurity Law No. 7545 (Siber Güvenlik Kanunu), published in the Resmî Gazete (Türkiye's Official Gazette) on 19 March 2025, places on those within its scope who provide services through information systems, or who collect or process data, the responsibility to notify the Siber Güvenlik Başkanlığı (Cybersecurity Presidency) without delay of any vulnerabilities or cyber incidents they detect in the area in which they provide services. You should assess with your legal team how the scope applies to your organization. However, keeping a record of who decided what from the moment a vulnerability is detected is a shared need for both notification and remediation.
A practical path to faster patch management
In its SP 800-40 Rev. 4 guide, the US National Institute of Standards and Technology (NIST) describes enterprise patch management as "preventive maintenance". One of the guide's core principles is that a separate risk assessment for every new vulnerability is not feasible, so decisions must be made quickly through plans prepared in advance. Another is that, because of the number of assets, software and patches, the pace of patching cannot be maintained without automation. Building on this framework, here is a checklist:
- Keep the inventory current. Prioritization is impossible without knowing which software is running where and in which version, and which assets are exposed to the internet. NIST recommends relying on automation as far as possible when updating the inventory.
- Divide assets into maintenance groups. Grouping assets with similar characteristics and similar maintenance needs makes it possible to write a single plan for each group.
- Write the four scenarios in advance. NIST recommends defining separate scenarios for routine patching, emergency patching, emergency temporary mitigation before a patch is available, and assets that cannot be patched. Postponing routine patches also makes a crisis worse, because in an emergency the accumulated patches have to be installed first.
- Put the priority rule in writing. CISA's four questions (internet exposure, known exploitation, suitability for automation, level of control) are a good starting point for an internal priority table. Set the deadlines according to your own risk appetite and, as Gartner recommends, update that appetite as well.
- Define all risk responses, not just the patch. NIST lists four responses: acceptance, mitigation (patching, disabling a feature, network segmentation), transfer (e.g., insurance, or using SaaS where the provider takes on patching) and avoidance (removing the software, decommissioning the asset). If patching is not immediately possible, the decision on a temporary measure should also be tied to a specific time limit.
- Automate deployment and verification. Verifying that the patch has been installed and the vulnerability closed is as important as triggering the installation. If reporting is not automated, time targets cannot be measured.
- Check supplier and cloud contracts. Clarify in writing how quickly the provider closes vulnerabilities in its own infrastructure and how it notifies you.
- Report to management regularly. The average time to close critical vulnerabilities, the number of vulnerabilities past their deadline and the list of assets that cannot be patched are simple indicators with which the board can monitor the risk.
Conclusion
As AI speeds up vulnerability discovery, the time between a vulnerability being found and being exploited may shrink. Gartner flags this as the quarter's top emerging risk; CISA, for its part, has reorganized patch priority for federal agencies around internet exposure, known exploitation, automation and level of control. The lesson for organizations is not to try to close every vulnerability at the same speed, but to be able to close the genuinely dangerous ones within days under a rule written in advance.
From Orient Global's perspective, a calm first step is to compile an inventory of internet-facing assets and create a written priority and deadline table for them.
Why logistics experience matters here. NIST's description of patching as preventive maintenance will sound familiar to anyone who has kept forklifts, conveyors and delivery fleets in service: an inventory of every unit, units grouped by class and maintenance need, a routine schedule alongside an emergency procedure, and attention weighted toward what matters most. What differs in a logistics or distribution business is that a patch window also has to fit the dispatch schedule, because the warehouse, transport and order systems that keep goods moving are typically connected to third parties, and a restart at the wrong moment can leave trucks waiting at the dock. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end-to-end, building and leading teams of 100+ people and delivering lasting gains in operational performance through KPI-driven programs. He has also managed nationwide warehouse and transport operations at leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information purposes only and is not a substitute for legal advice.
#interimmanagement #forwarddeployedengineering