For decades, enterprise security ran on one quiet assumption: there would be time. Time to find the vulnerability, rate it, route it through approvals, wait for a patch window, and deploy the fix.
According to new McKinsey research, that assumption no longer holds.
In The speed problem: How frontier AI exposes weakness in enterprise cybersecurity, Benjamin Klein, Charlie Lewis, Rich Isenberg, Venky Anant, and co-authors from McKinsey's Risk & Resilience Practice argue that the defining shift in cybersecurity isn't more sophisticated malware—it's the collapse of time.
Their diagnosis, timed to Cybersecurity Awareness Month, is pointed: most organizations don't have a technology problem; they have an operating-model problem.
The headline number comes from industry tracking data at Zerodayclock.com, which McKinsey cites. Mean time to exploitation for critical vulnerabilities fell from roughly 23 days in 2025 to an estimated 20 hours in 2026.
The authors attribute that compression to frontier AI models that can autonomously generate working exploits at scale and at negligible cost. They name Anthropic's Mythos/Fable, OpenAI's GPT-Cyber, and Google's Gemini as a genuine step change, not because they speed up existing attacker workflows, but because they open vulnerability discovery and exploitation to a much larger pool of attackers.
McKinsey's own analysis goes further, suggesting that critical novel vulnerabilities without available patches now make up most active exposures. That reframes the question for CISOs. It's no longer whether a vulnerability gets exploited before it's patched. It's how many will be.
A companion McKinsey blog on public-sector cybersecurity points to the event that crystallized the threat: Anthropic's disclosure, through Project Glasswing in April, that its Mythos Preview model had autonomously found thousands of high- and critical-severity vulnerabilities across major operating systems and browsers.
The research's most useful contribution is its walk-through of what actually happens when a critical vulnerability lands at a large enterprise. Security identifies and scopes it, which can take a day or more because asset inventories are incomplete across legacy, cloud, SaaS, and OT. Then, IT leadership assesses business impact. Application owners weigh release schedules and change freezes. Patches get tested, sometimes for weeks on legacy code. Business leaders negotiate the window. A change advisory board that may meets weekly signs off. And third-party systems run on patch timelines nobody inside controls.
The authors are careful to say this isn't dysfunction. Those processes exist to protect uptime, compliance, and service quality. But when exploitation happens in hours, they write, organizational architecture itself becomes a security liability.
The root problem, in McKinsey's framing, is that "nobody owns decision speed." IT owns patching, the business owns downtime, legal owns disclosure, procurement owns vendors, operations owns continuity, and security owns risk. No one function has the authority, visibility, and mandate to move at the pace the threat demands.
For practitioners, that gap is starker when set against remediation reality. Cognizant, which sells frontier-AI defense services, puts typical enterprise remediation of a critical vulnerability at 55 to 70 days on its own marketing materials. Even if that figure is generous, the distance between a 20-hour exploit window and a two-month fix cycle is the whole story.
The research proposes a model it calls governed autonomy: AI handles high-volume, time-sensitive work like continuous monitoring and routine remediation, while humans govern novel threats, strategic risk calls, and anything material to the business. It rests on three design imperatives, each organizational before it is technical.
1. Continuous visibility, starting small
Rather than chasing real-time visibility across the enterprise, which the authors say consistently fails, organizations should define a minimum viable organization: the irreducible core for which disruption would be existential. For a bank, that's payments, core banking, and regulatory reporting. For a hospital, clinical and life-critical systems. Concentrate scanning there, and shrink the attack surface in parallel by retiring external-facing assets, rationalizing open-source dependencies, and removing stale credentials. One global financial institution, the authors report, cut exposure around its highest-value assets faster and more cheaply by focusing LLM-based scanning on its "minimum viable bank."
2. AI-enabled defense as core architecture
McKinsey describes three layers, each designed as an end-to-end agentic workflow rather than a stack of point products: attack-path discovery that prioritizes by real exploitability and proximity to crown jewels instead of generic CVSS scores; AI-assisted threat modeling and patch generation to shrink the fix cycle; and incident response where agents are preauthorized to take bounded actions like isolating systems or revoking credentials, with human review following the action for low-risk responses.
3. Decision architecture built for time pressure
This is the imperative the authors call most underestimated. Their recommended structure is a small, cross-functional response cell led by a single decision-maker holding CSO-delegated authority to override standard change management for confirmed active threats. It runs daily triage, owns a live vulnerability backlog, and reports to the board every 24 hours.
The case examples make the point concrete. One financial institution rebuilt its patch governance after a critical vulnerability sat unpatched for 11 days because no team had both the visibility and the authority to break a production change freeze. Under the new model, post-action reporting replaced pre-action approval for active threats, and remediation timelines dropped significantly. A pharmaceutical company, meanwhile, fixed chronic R&D patch backlogs only after a business-led change program gave security standing authority to override development schedules.
The research is blunt about sponsorship. Organizations that run governed autonomy as a security program stall, the authors argue, because the real bottlenecks are business decisions about downtime, change authority, and vendor obligations that a CISO can't resolve alone. It has to be an enterprise resilience program with CEO and board backing.
They also warn against skipping steps. Deploying AI agents into an environment where decision authority is still diffuse produces AI recommendations nobody acts on.
In a related blog, Charlie Lewis, Cameron Shane, Daniel Wallance, and Parth Jagodara apply the same logic to government agencies, where staffing and budgets are tighter and the systems at stake are ones citizens can't do without.
Their guiding principle is "using agents to extend human reach while ensuring humans retain judgment over consequential actions." They lay out a four-phase path: baseline readiness (including telemetry integration and data quality), score candidate domains, pilot three to five with kill switches and human review, then roll out in one or two areas chosen for impact and reversibility. They also flag a government-specific risk: agents touching tax, health, benefits, or licensing records must operate within privacy obligations, with access scoped and logged.
Frontier AI isn't the only thing compressing timelines. In Quantum is almost here: Are you and your systems ready?, Lewis, Henning Soller, and Sebastian Schneider note that many expect Q-Day—when quantum computers can break the public-key cryptography behind digital trust—in the 2030s or sooner. U.S. NIST has urged organizations to begin applying its post-quantum cryptography standards, and the UK's NCSC has set migration targets running through 2035.
Yet, a Trusted Computing Group survey they cite found that 91% of businesses have no roadmap for quantum threats. With harvest-now, decrypt-later attacks already possible, the authors conclude that waiting for definitive proof of vulnerability from quantum is a high-risk strategy. Their prescription echoes the speed paper: build a living cryptographic inventory, design for crypto agility, and stand up cross-functional leadership rather than leaving it to the security team.
McKinsey's diagnosis is sharp, and the "nobody owns decision speed" framing will land with any CISO who has watched a critical patch wait on a CAB meeting. A few caveats are still worth naming.
The 20-hour figure comes from a single tracker and, as McKinsey's own footnote says, represents a trend estimate for high-severity, actively-exploited vulnerabilities; individual cases vary. The claim that unpatched novel vulnerabilities now dominate active exposures cites "McKinsey analysis" without published methodology. The case studies are anonymized, and the improvements are described qualitatively.
There's also the source to consider. McKinsey sells exactly the kind of operating-model transformation it recommends, and "governed autonomy" is a branded framework, not an industry standard.
Finally, the model introduces risks of its own, which the authors acknowledge. Preauthorized agents with broad access are themselves high-value targets; a patching agent, they note, must be treated as a critical asset protected against compromise or behavioral drift. And they flag the cost per query of running large models continuously as a new budget pressure that traditional security spending models weren't built to absorb.
Map your patch chain end to end. Time every handoff from discovery to deployment for a recent critical CVE. The longest delay is rarely technical.
Define your minimum viable organization. Agree with the business on which systems must keep running when everything else is quarantined, and focus continuous scanning there first.
Assign decision authority before the incident. Name who can override a change freeze for a confirmed active threat, and switch to postaction reporting for preapproved actions.
Write the playbooks agents will run. Decide which bounded actions, such as isolation, credential revocation, and compensating controls, can execute without waiting for a human.
Treat your AI defenders as crown jewels. Scope their access, log their actions, and define when their autonomy is automatically revoked.
Start the cryptographic inventory. The same asset-visibility gaps that slow patching will slow post-quantum migration.
The most important line in McKinsey's research may be its last argument: over the next three to five years, the clarity of the operating model will matter far more than the size of the security budget. Attackers already move at machine speed. The question for every enterprise is whether its decision-making can be redesigned to match—before the next 20-hour window opens.