“You will never patch fast enough” (or: 5 days to exploit, 32 days to patch, and why better triage doesn’t close that)

There’s a six-part series on the NetFoundry blog with a title that’s becoming only more apparent as we move further into the Age of AI: You Will Never Patch Fast Enough. Here’s the Math. It’s written by Jack Poller. Yes, his title says VP Product Marketing, but he has a long history as a developer, so he’s got first-hand experience with what fixing software used to be like, and an educated view into what it’s like now. So the “here’s the math,” part of the title makes it clear that this is an article written by someone who’d rather show you the arithmetic than the adjectives. Jack kicked off the series on our blog yesterday, and here’s my summary: The numbers From Verizon’s 2025 DBIR and FIRST’s mid-year forecast: Disclosures: 40,000+ CVEs in 2024, up 38% year over year. FIRST’s June revision puts 2026 near 66,000, which is considerably higher than the February projection of 59,427, and running about 46% above that baseline through April. Remediation: for the edge and VPN device…