AnswersPublished14 sources
Why AI-Speed Exploits Demand Defenses Beyond Patching
a16z’s core argument is that security cannot rely on patching alone: median full remediation is 43 days, and only 26% of known exploited vulnerabilities in Verizon’s dataset were fully remediated. The report frames the shift as six security product opportunities.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- a16z’s core argument is that security cannot rely on patching alone: median full remediation is 43 days, and only 26% of known exploited vulnerabilities in Verizon’s dataset were fully remediated.
- The report frames the shift as six security product opportunities. Available excerpts support the broader focus on machine speed protection, identity, recovery and software screening, but do not verify every detail or...
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What do a16z investing partner Asaf Ezra and growth partner Stephenie Zhang argue in their November 6, 2026 report “Defense in Depth, Rebuil. Article summary: Ezra and Zhang’s central argument is that cheap AI-generated exploits break the timing assumptions behind human-run patching: defenses must protect systems while permanent fixes are still being prepared, tested and deplo. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
AI can make it cheaper to turn software flaws into working exploits, but it has not made the full process of fixing and deploying software equally fast. In their November 6, 2026 report, a16z’s Asaf Ezra and Stephenie Zhang argue that cybersecurity needs defenses that protect systems during that gap—not just better patching. 1
2
The patching gap is the security problem
The report points to a mismatch between how quickly vulnerabilities can become exploitable and how long remediation takes. It cites Verizon’s 2026 findings: median full remediation took 43 days, and only 26% of known-exploited vulnerabilities in the dataset were fully remediated. 1
Ezra and Zhang’s preceding argument, as summarized in the November 6 report, is that the skilled work of turning a bug into a working exploit became cheaper in 2025 and 2026, while patching did not speed up at the same rate. Their conclusion is that the gap will not be closed simply by patching harder. 2
That does not mean patches are unnecessary. It means organizations need ways to reduce exposure while a permanent fix is still being developed, tested and deployed.
Why interim protection matters
The report’s PHP example illustrates the problem for software that cannot be updated quickly—or may never receive another fix. An account by Ezra describes two critical PHP bugs leaking before their fixes and says between 2.6 million and 4.4 million installations outside a protective service remained exposed, most running versions that would not receive a fix. 37
In that kind of situation, a defensive rule applied in front of vulnerable systems can provide a layer of protection before every installation is patched. The report argues for using machine-speed capabilities to help generate and distribute defensive rules, including for systems outside major cloud platforms. 2
37
The distinction is important: a temporary shield can narrow the exposure window, but it is not the same as repairing vulnerable software. Systems still need durable fixes where available, and organizations need to consider what happens if an interim protection fails or becomes unavailable.
The security capabilities behind the thesis
Ezra and Zhang describe the report as identifying six generational opportunities in security products. 1
2 The excerpts available here do not provide enough detail to verify a complete, item-by-item list. A secondary summary of the report highlights several broad themes: segmentation, machine-speed detection, per-request identity checks, tested backups and supply-chain controls.
34
Together, those themes point toward a broader security approach:
- Contain attacks while fixes are pending. Segmentation and other controls can limit the reach of an intrusion rather than assuming every vulnerable system can be patched immediately.
34
- Detect and respond at machine speed. Faster exploit development raises the value of detecting threats and applying protective measures quickly. The report’s central premise is that defenses must keep pace with the changing speed of exploitation.
2
- Verify access continuously. Per-request identity checks are one of the product themes identified in the secondary summary, extending the focus beyond a one-time login.
- Prove recovery works. Tested backups and recovery are another highlighted theme: protection should include the ability to restore operations, not just prevent an initial compromise.
- Screen software and dependencies. Supply-chain controls address risk that enters through software or tools an organization adopts.
These are themes, not a verified reproduction of all six categories or their detailed product specifications. The available excerpts also do not substantiate several more precise claims associated with the report, including specific alert volumes, credential-expiry intervals, ransomware percentages or the exact timing of exploit creation from published fixes.
The practical takeaway: protect first, repair permanently
The strongest takeaway is not to choose between patching and other defenses. It is to treat them as complementary layers: reduce the chance and impact of exploitation now, then apply and verify permanent fixes when they are ready. 1
2
That approach is especially relevant for systems that cannot be updated quickly. But interim protections should not be mistaken for a complete solution; the report’s PHP example shows why the exposure remains serious when installations sit outside protective coverage or cannot receive fixes. 37
The opportunity Ezra and Zhang see is therefore broader than faster vulnerability scanning. It is a security stack that can contain attacks, identify risk, control access and support recovery even when patching cannot keep pace.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Why AI-Speed Exploits Demand Defenses Beyond Patching"?
a16z’s core argument is that security cannot rely on patching alone: median full remediation is 43 days, and only 26% of known exploited vulnerabilities in Verizon’s dataset were fully remediated.
What are the key points to validate first?
a16z’s core argument is that security cannot rely on patching alone: median full remediation is 43 days, and only 26% of known exploited vulnerabilities in Verizon’s dataset were fully remediated. The report frames the shift as six security product opportunities. Available excerpts support the broader focus on machine speed protection, identity, recovery and software screening, but do not verify every detail or...