Symantec analyst urges firms to move beyond patching

Dick O’Brien, principal intelligence analyst at Symantec, told IRISSCON 2026 in Dublin that organisations cannot patch their way out of the AI era and must shift to mitigation after exploitation. He highlighted the collapsing patch window as attackers deploy AI to discover zero‑day flaws and to chain together low‑severity issues into exploits.

The Zero Day Clock dashboard estimates the average time from CVE disclosure to confirmed exploitation in the wild fell from about one week in 2025 to one day in 2026, with a projected minute in 2027, underscoring the urgency of moving beyond patch-centric defences.

O’Brien pointed to the rapid exploitation of the PHP2Shell vulnerability announced in October 2026, noting first reporting exploitation attempts 19 minutes after disclosure, while Amazon reported an exploitation attempt four days before public publication.

The discussion, framed as “agentic AI orchestration of attacks,” envisages post‑initial access campaigns driven by autonomous AI agents operating at machine speed, complicating detection and response for defenders. Symantec’s analysis of a September 2026 attack on the Dutch Institute of Vulnerability Disclosure found that while the breach was detected in 19 minutes, containment and remediation lagged by 33 hours.

O’Brien urged organisations to adopt an “assume exploit” mindset and to measure mean time to mitigate rather than patch, outlining immediate mitigations such as behaviour blocking, default‑deny for what runs, least privilege for every agent and token, data inspection before exfiltration, and binding agent actions to a named human, with longer‑term goals of multi‑point detection to spot rogue AI activity.