N-day is Becoming N-Hour. Patching Faster Won't Save You.

Every patch is a confession.

The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken and where. Turn that diff back into a working exploit, and you can hit every system that hasn't updated yet. This is N-day exploitation, and it's always been a race: the vendor patches, the clock starts, and defenders try to deploy before an attacker finishes reverse-engineering the fix.

For the last thirty-odd years, defenders usually won that race.

Reverse-engineering a patch into a reliable exploit was slow, specialized work - usually requiring weeks of expert-level effort. Historically, the gap between a patch and a working public exploit spanned weeks, often months.

The traditional playbook assumed you had at least a few weeks. You don't anymore. Not even close.