Claude Mythos Killed the Patching Window: What Marketers Must Know

On April 7, 2026, Anthropic’s specialized security AI — Claude Mythos — demonstrated it can autonomously discover previously unknown software vulnerabilities without being handed a CVE description to work from. The assumption that enterprise security teams have days or weeks to patch before AI-assisted exploitation materializes just died. If your marketing organization runs a modern martech stack — CDPs, email platforms, ad tech, AI-powered CRMs, marketing automation — you are now operating in a threat environment where the safe patching window has effectively collapsed to zero.

What Happened

The 2024 Baseline: A False Sense of Security

In 2024, researchers from the University of Illinois published a landmark paper that became the foundation of the enterprise security industry’s confidence in AI risk management. Their finding: GPT-4, when given a Common Vulnerabilities and Exposures (CVE) description, could autonomously exploit 87% of a curated 15-vulnerability one-day dataset. Without the CVE description, it could only exploit 7%. Every other tested model — GPT-3.5, open-source LLMs — sat at 0%. Traditional tools like ZAP and Metasploit also scored 0%.

That 80-point performance gap was what the industry called the “margin of safety.” It meant that even if an attacker could leverage AI to operationalize a known exploit, they still needed a human to discover and disclose the vulnerability first. That created a sequential dependency: a CVE gets published, exploit developers race to weaponize it, IT teams patch before exploitation reaches scale. The model was imperfect, but it gave security teams a working framework and gave enterprises something to plan around.

April 7, 2026: The Margin of Safety Disappears

That assumption broke on April 7, 2026, when VentureBeat reported on Claude Mythos’ breakthrough capabilities. Unlike general-purpose AI models, Claude Mythos is purpose-built for cybersecurity work. It scored 83.1% on the CyberGym vulnerability reproduction benchmark — but more critically, it demonstrated the ability to autonomously discover zero-day vulnerabilities without needing CVE descriptions as starting input.

What makes Mythos different from previous AI security tools is the combination of capabilities it brings to bear: it can map an attack surface, identify candidate weaknesses, develop proof-of-concept exploits, and validate them — all without requiring a human researcher to have previously discovered and disclosed the flaw. The sequential dependency that underpinned the “margin of safety” concept is no longer a reliable constraint on the speed of exploitation.

The VentureBeat analysis also documented the cost structure of this new threat landscape: running an exploitation campaign against OpenBSD now costs less than $20,000 across 1,000 scaffold runs. Offensive security capability that was previously the domain of nation-state actors or well-capitalized criminal organizations now carries startup economics. The barrier to entry for AI-assisted vulnerability exploitation has dropped dramatically.

Project Glasswing: The Scale of What Was Found

Anthropic did not release Mythos to the public. Instead, it launched Project Glasswing — a coordinated initiative with approximately 50 partner organizations to use Mythos defensively, finding and patching vulnerabilities before adversaries could exploit them. The first-month results, published May 22, 2026, illustrate both the power of AI-assisted vulnerability discovery and the massive scale of the problem it revealed.

Partners collectively found over 10,000 high- or critical-severity vulnerabilities in the first month. Some partners reported bug-finding rates increasing by more than tenfold compared to their previous methods. Cloudflare discovered 2,000 bugs — 400 rated high or critical — with false positive rates comparable to human security testers. Mozilla found 271 vulnerabilities in Firefox during its Glasswing evaluation, described as “over ten times more” than earlier AI models had surfaced. Palo Alto Networks released more than five times its usual monthly patch volume in response to findings from the initiative. Oracle addressed at least 450 flaws in its quarterly update, over 300 of them remotely exploitable without authentication, and subsequently switched to a monthly critical-issue update cycle.

One finding from the open-source scanning portion of Project Glasswing illustrates what is at stake at a systemic level: Mythos Preview detected a critical vulnerability in wolfSSL, an open-source cryptography library used by billions of devices. The flaw would have enabled attackers to forge certificates and conduct credential theft attacks at scale — a vulnerability embedded in the global software supply chain, invisible until AI found it.

Anthropic’s scanning of over 1,000 open-source projects identified an estimated 6,202 high- or critical-severity vulnerabilities out of 23,019 total findings. Of 1,752 carefully assessed vulnerabilities, 90.6% proved valid, with 62.4% confirmed as high or critical severity. Claude Security — Anthropic’s enterprise security product released in public beta alongside the Glasswing announcement — helped patch 2,100 vulnerabilities in its first three weeks.

Why This Matters to Marketers

Marketing teams are among the most data-rich, externally exposed parts of any enterprise. Customer data platforms hold complete customer graphs — names, addresses, behavioral histories, purchase records, and identity linkages. Email marketing platforms have authenticated pipelines directly into customer inboxes. Marketing automation tools integrate with CRMs, billing systems, and identity providers. Paid media platforms manage credentials that control millions in monthly ad spend. And in 2024 and 2025, virtually every marketing organization added AI tools — content generation, predictive analytics, AI-powered CRM features — that expanded the code surface and data exposure running inside the marketing function.

The Exploitation Timeline Has Collapsed

According to VentureBeat, exploitation timelines have already compressed to hours in documented, real cases:

• CVE-2026-33017 affecting Langflow (CVSS 9.8): actively exploited 20 hours after disclosure, with no public proof-of-concept available at the time exploitation was observed.
• CVE-2026-39987 affecting Marimo (CVSS 9.3): exploited in 9 hours and 41 minutes post-disclosure.

These are not edge cases isolated to obscure platforms — they are the new baseline for high-severity CVEs in the current threat environment. Rapid7’s 2026 vulnerability intelligence report (as cited in VentureBeat) found that the median time from CVE publication to a vulnerability appearing on CISA’s Known Exploited Vulnerabilities (KEV) list is five days. Google’s M-Trends 2026 found that the mean time to exploit (MTTE) is now negative seven days — meaning exploitation is routinely happening before patches are even released to the public.

An enterprise patching process built for a 30-day window — or even a 7-day emergency cycle — is not operating in the same threat environment that actually exists. The gap between “vulnerability disclosed” and “actively weaponized” has collapsed from weeks to hours, and in some cases to before disclosure at all.

Marketing Ops Is Often the Security Weakest Link

Marketing organizations systematically accumulate “shadow IT” — tools adopted outside of formal IT governance because they are convenient, self-serve, or available on a free trial. The social listening tool someone signed up for in 2022. The landing page builder nobody remembers approving. The analytics plugin that went unsupported after its vendor pivoted. The AI writing assistant someone put on a personal card and expensed at the end of the quarter.

Every one of these tools runs software. Software has vulnerabilities. When those vulnerabilities are disclosed, the question is no longer “when will someone build an exploit?” With Mythos-class models in the ecosystem, the question has become “does this vendor have a patch available before someone points an AI agent at the disclosed CVE?” For startup-tier martech vendors with small engineering teams and slow release cycles, that is an increasingly difficult bar to clear.

The Cascading Risk for Marketing Data

A breach in a martech tool is not just an IT incident — it is a marketing catastrophe with compounding consequences. GDPR breach notification requires disclosure within 72 hours of becoming aware of a personal data breach — a timeline that most organizations without real-time detection tooling struggle to meet. Beyond the regulatory clock, a data breach involving customer PII generates documented, sustained erosion of conversion rates and customer lifetime value. A paid media account takeover can drain months of ad budget in hours, and recovery from ad platforms after fraud is slow and often incomplete. Email domain reputation damage from a compromised ESP can degrade deliverability for months, affecting every campaign in the pipeline. Brand damage amplifies through social media faster than any PR response can counter.

The people who manage the aftermath of all these consequences are marketers — not the security team that patched the vulnerability. The security team closes the technical exposure; the marketing team rebuilds customer relationships, email deliverability, platform trust scores, and campaign performance. The operational cost sits squarely in marketing’s budget and KPIs.

The Data

Exploitation Timeline Collapse: 2024 vs. 2026

Project Glasswing First-Month Impact by Partner

The last row is the number every marketing technology leader needs to hold onto: even with active disclosure by a major AI lab to maintainers of open-source software, the average patch time for high or critical severity findings is approximately two weeks. That is far slower than the hours-scale exploitation window documented in the table above it.

Martech Stack Vulnerability Exposure by Tool Category

Real-World Use Cases

Use Case 1: The Customer Data Platform Breach Window

Scenario: A mid-market e-commerce brand self-hosts an open-source analytics platform integrated with its CDP. The platform uses an open-source cryptographic library for authentication — analogous to the wolfSSL vulnerability Anthropic found during Project Glasswing, which affected billions of devices. A CVE drops on Tuesday afternoon. By Wednesday morning, it is being actively exploited in the wild against unpatched instances.

Implementation: The marketing operations team should maintain a living inventory of every open-source dependency in its self-hosted stack, linked to CVE monitoring feeds via automated tooling. When a new CVE matches a listed component, an automated alert fires to both marketing ops and IT security simultaneously — not an email that sits unread overnight. Policy should pre-authorize taking the affected integration temporarily offline until a confirmed patch is deployed, rather than leaving the system running during a quarterly maintenance wait. The business trade-off is one day of integration downtime versus weeks of exposure on a customer data pipeline.

Expected Outcome: Teams with CVE monitoring integrated into their martech inventory can compress the window from “CVE published” to “defensive action initiated” from weeks to hours — matching the exploitation timeline rather than trailing it by months. Without this, a Tuesday CVE becomes a Wednesday data breach.

Use Case 2: The AI Marketing Tool Supply Chain Attack

Scenario: A performance marketing agency has deployed a third-party AI copywriting tool across 40 client accounts. The tool stores client brand briefs, audience parameters, and campaign performance data in the vendor’s cloud. The vendor’s backend runs on a Python web framework that just received a CVSS 9.3 CVE — exactly the severity class that VentureBeat documented as being exploited within 9-10 hours of disclosure.

Implementation: Agencies need to incorporate vendor security posture into their standard martech evaluation and annual renewal process. The questions to require answers to: What is your mean time to patch critical CVEs? Do you publish a security advisory feed? What is your breach notification SLA? When a CVE drops against a category of tools, proactively contact all vendors in that category and request patch status confirmation within 24 hours. If a vendor cannot confirm a patch is in progress within that window, suspend client data synchronization until confirmation is received and documented.

Expected Outcome: Agencies that build explicit security SLAs into vendor contracts gain two advantages: contractual leverage to compel fast remediation, and a documented audit trail that limits liability exposure if a breach occurs. Agencies without these protections absorb both the operational disruption and the reputational consequences of a vendor’s slow response.

Use Case 3: The Paid Media Account Takeover

Scenario: A brand’s in-house marketing team manages $1.8 million per month in paid search and social spend through an ad management platform. The platform’s browser-based dashboard uses a JavaScript library with a newly disclosed cross-site scripting vulnerability. The CVE drops Friday at 4:30 PM, when IT security is running a skeleton crew. By Saturday morning, an attacker has used the XSS flaw to steal session tokens, accessed the advertising accounts, and redirected $220,000 in spend before anyone checks in Monday morning.

Implementation: Marketing teams need automated monitoring on platform activity that triggers on security anomalies, not just performance metrics. Configure alerts for: authentication events from unrecognized geographies, budget pacing deviations greater than 20% above baseline within any one-hour window, API call volume spikes outside normal operating hours, and bulk audience export requests at abnormal times. Enforce hardware MFA (FIDO2 keys) on all ad platform accounts — software-based TOTP tokens can be bypassed in certain attack scenarios; hardware tokens cannot. Contact ad platform vendor account teams to enable any fraud-hold features that exist but are off by default.

Expected Outcome: With real-time anomaly monitoring deployed, detection time compresses from hours to minutes, substantially limiting exposure in a live attack. Recovery from ad platforms after confirmed fraud is slow and often partial — prevention is the only reliable financial protection against account takeover scenarios.

Use Case 4: The Self-Hosted Marketing Automation Emergency Patch

Scenario: A B2B marketing team runs a self-hosted marketing automation instance for data sovereignty. The underlying server environment receives a critical infrastructure CVE — comparable in scope and severity to the vulnerabilities surfaced by Project Glasswing. The team’s IT liaison informs them that patches are scheduled through the quarterly maintenance window, still six weeks away.

Implementation: For self-hosted marketing infrastructure, teams need a tiered patching policy that explicitly separates critical security patches from feature releases and routine maintenance. Any CVSS 9.0+ vulnerability should be pre-authorized for immediate out-of-cycle deployment — with post-hoc documentation rather than prior approval requirements. The marketing team leader needs to actively sponsor this policy with IT leadership, framing it in business risk terms: six weeks of unpatched critical exposure on the system that holds the entire B2B prospect database and pipeline is not a scheduling preference — it is a material business risk that needs executive visibility.

Expected Outcome: Organizations that adopt a tiered patching policy — P0 (CISA KEV): 24-hour remediation; P1 (CVSS 9+): 72-hour remediation; P2 (all other high): 7-day remediation — eliminate the dangerous gap that currently exists between CVE publication and patch deployment. This mirrors the logic driving Mozilla’s move to weekly releases, Oracle’s monthly critical-issue cycles, and Chrome’s fourfold increase in May 2026 patch volume.

Use Case 5: The Vulnerability Prioritization System for Marketing Ops

Scenario: A marketing technology director is responsible for a 60-tool enterprise martech stack. Hundreds of CVEs are published every month across the software ecosystem. She lacks a dedicated security analyst on her team and cannot escalate every CVE to IT without eroding the cooperative relationship she needs when genuine emergencies occur. She needs a triage framework that clearly separates emergencies from background noise.

Implementation: The three-layer prioritization filter outlined in VentureBeat provides the right operational framework:
1. Layer 1 — CISA KEV Status: If a CVE appears on CISA’s Known Exploited Vulnerabilities catalog, active exploitation is confirmed in the wild. This is a P0 — escalate to IT security within the hour regardless of CVSS score or EPSS rating.
2. Layer 2 — EPSS Score: The Exploit Prediction Scoring System assigns probability scores for near-term exploitation. Any CVE scoring above 0.5 on EPSS and affecting systems in your stack warrants immediate action even before CISA lists it.
3. Layer 3 — CVSS Rating: CVSS 9.0+ on any system that touches customer data or payment credentials is the threshold for emergency response escalation.

Expected Outcome: According to VentureBeat, this three-layer filter delivers an 18x efficiency gain — covering 85.6% of actively exploited vulnerabilities while reducing the urgent remediation workload by approximately 95%. That is a framework a marketing ops team without security headcount can realistically execute while keeping IT security as a trusted partner rather than an adversarial bottleneck.

The Bigger Picture

The Claude Mythos development is not an isolated incident — it is a threshold crossing in a capability trajectory that has been visible and accelerating since 2023. What changed in April 2026 is that AI moved from “weaponizing known vulnerabilities at scale” to “discovering new ones autonomously,” closing the loop on fully autonomous offensive security operations. The earlier UIUC research established that AI had arrived at scale exploitation of known flaws. Mythos crossed the line into discovering unknown ones.

The defensive response — Project Glasswing — represents exactly the kind of coordinated industry action this moment demands. Fifty major technology companies using an AI lab’s most capable security model to proactively scan their own codebases before adversaries get there is a structural upgrade to how software security works at the industry level. The scale of what they found (10,000+ critical vulnerabilities in a single month) tells you something important about the pre-Glasswing state: the attack surface was substantially larger than anyone realized, and traditional security methods were not finding it.

The patch volume data from Krebs on Security confirms that major technology organizations are already restructuring their update cadence in response to the new reality. Microsoft pushed 118 security fixes in May 2026, following a near-record 167 in April. Apple shipped 52 patches in May — nearly triple its historical average of approximately 20 per cycle. Chrome went from 30 security fixes in April to 127 in May, a more than fourfold increase in a single month. Mozilla, following its Firefox 150 Glasswing findings, moved to weekly security releases. As Ivanti VP Chris Goettl told Krebs on Security: “Since Firefox 150.0.0 released, they have been on a more aggressive weekly cadence for security updates including the release of Firefox 150.0.3 on May Patch Tuesday resolving between three to five CVEs in each release.”

For marketing technology leaders, this industry response is a signal: the vendors you depend on are now operating on compressed release cycles that generate patches faster than ever before. The question is whether your internal patch deployment processes can keep pace with that cadence, or whether your production martech stack will consistently be running versions that are weeks behind the current security state.

Google’s M-Trends 2026 adds critical operational context. The global median attacker dwell time is now 14 days. For cyber espionage intrusions, it is 122 days. The BRICKSTORM backdoor maintained persistence for approximately 400 days across standard enterprise remediation cycles — meaning organizations were going through their normal patching processes while a sophisticated backdoor was already in place, watching. The alert hand-off window — the time between when an intrusion is initially detected and when the attacker responds to defensive actions — collapsed from more than 8 hours in 2024 to 22 seconds in 2025. These are not theoretical projections. They are documented measurements from analyzed real-world breaches.

The M-Trends 2026 report also documented the emergence of AI-versus-AI attack dynamics that will shape the next phase of this threat landscape. Malware families called PROMPTFLUX and PROMPTSTEAL actively query large language models mid-execution to adapt their behavior and evade detection in real time. QUIETVAULT credential-stealing malware checks compromised machines for local AI command-line tools and executes predefined prompts to search configuration files. This is the beginning of a dynamic in which offensive AI tools and defensive AI tools operate against each other at machine speed — a dynamic that will require AI-native defense architecture, not just faster human response.

From a regulatory and legal standpoint, marketing organizations are accumulating compliance exposure they have not fully priced in. GDPR’s 72-hour breach notification window is extremely difficult to meet without real-time detection tooling in place. California’s CPRA introduced stricter consent and disclosure requirements for sensitive personal information. The FTC Safeguards Rule applies to any organization that handles consumer financial data — which includes most e-commerce marketing operations. Marketing organizations that have not mapped their data flows through their martech stack to specific regulatory obligations are holding legal exposure alongside the technical exposure.

What Smart Marketers Should Do Now

1. Complete a full martech stack inventory — including shadow IT — within the next 30 days.

Most marketing organizations, when they actually conduct this exercise, discover 20 to 40 percent more tools than anyone had accounted for. You cannot defend what you have not cataloged. The inventory should document for every tool: vendor name, hosting model (SaaS versus self-hosted), what data it touches, who owns the vendor relationship internally, and the version or most recent update confirmed. This asset register is the prerequisite for every security action that follows. Without it, you are flying blind when a critical CVE lands on a tool type you forgot you had.

2. Implement the CISA KEV + EPSS + CVSS three-layer prioritization filter as your standard triage process.

Subscribe to CISA’s Known Exploited Vulnerabilities catalog — it is free and available at cisa.gov. Set up monitoring for EPSS scores on CVEs affecting software categories in your martech inventory. Establish explicit escalation thresholds in writing: CISA KEV appearance means escalate to IT security within the hour; EPSS score above 0.5 means same-day IT engagement; CVSS 9.0+ on a customer-data system means emergency patching required within 72 hours. According to VentureBeat, this framework covers 85.6% of actively exploited vulnerabilities while reducing the remediation workload by 95%, making it executable even for teams without dedicated security staff.

3. Sponsor a tiered emergency patching SLA with IT leadership — and bring the business case.

The change management case for accelerating patch deployment cadence is stronger coming from marketing than from IT, because marketing can quantify the revenue at risk in concrete terms: customer PII value at risk, monthly ad spend under management, projected regulatory fine exposure, and customer LTV erosion from breach scenarios. Bring the exploitation timeline data from VentureBeat and the 5-day CVE-to-KEV median from Rapid7 to the executive conversation. Propose a three-tier policy: P0 (CISA KEV-listed) — remediation within 24 hours; P1 (CVSS 9.0+) — remediation within 72 hours; P2 (all other high-severity) — remediation within 7 days. This is not an aggressive ask in the current threat environment — it is the minimum defensible standard.

4. Add vendor security posture requirements to all martech contract evaluations and renewals.

When evaluating new tools or renewing contracts with existing vendors, require explicit answers to security posture questions: What is your mean time to patch critical CVEs? Do you publish a public security advisory feed or a security changelog? What is your breach notification SLA? Have you participated in any AI-assisted security scanning programs? Vendors who cannot or will not answer these questions clearly represent elevated risk. As more major platforms accelerate their patch cadences under pressure from AI-assisted vulnerability discovery programs, security responsiveness is becoming a meaningful competitive differentiator among martech vendors — and a reasonable selection criterion alongside feature set and pricing.

5. Deploy real-time anomaly monitoring on your highest-risk marketing systems today.

For paid media platforms, email service providers, and CDPs: enable every native alerting feature the platform offers, starting with authentication anomalies, budget pacing deviations, and bulk data export events. Most platforms have these controls available but disabled by default. For platforms that lack native security alerting, route API logs into a SIEM or a lightweight webhook-to-Slack pipeline. The goal is to compress your detection-to-response time from hours to minutes — because at the speed documented in the M-Trends 2026 report, where the attacker response window is 22 seconds, a human monitoring cadence measured in hours is not a viable detection strategy for anything beyond catching the aftermath.

What to Watch Next

Claude Mythos Public Availability and Competitive Parity

Anthropic’s Project Glasswing announcement explicitly stated that Mythos-class models will not be released to the public until stronger safeguards are developed. However, the competitive AI landscape makes it near-certain that other labs are developing comparable capabilities. Watch Anthropic’s safety framework updates and any announcements about the Cyber Verification Program — the current mechanism for authorized security professionals to access elevated capabilities — as leading indicators of when broader access opens. The moment Mythos-class capabilities become commercially accessible, the threat model for every enterprise shifts again.

EPSS Methodology Evolution for AI-Accelerated Exploitation

The Exploit Prediction Scoring System is a critical prioritization tool, but its scoring models are calibrated against historical exploitation patterns. As AI systems fundamentally change the economics and speed of exploit development — compressing the timeline from weeks to hours for certain vulnerability classes — EPSS scores trained on pre-AI data may systematically underestimate risk for newly disclosed CVEs in well-understood software categories. Watch FIRST’s EPSS working group for methodology announcements in Q3 and Q4 2026, and treat current EPSS scores as conservative estimates rather than ceiling predictions for any CVE category where AI tools have demonstrated strong exploitation performance.

Martech Vendor Security Consolidation and Attrition

The wave of vulnerabilities being surfaced through Project Glasswing and similar programs will create sustained, compounding pressure on martech vendors. Organizations without the engineering resources to respond to accelerating CVE disclosure rates will accumulate technical debt faster than they can service it. Watch for major marketing cloud vendors — Salesforce, HubSpot, Adobe Experience Cloud, Oracle Marketing Cloud — to announce dedicated AI-assisted security scanning programs of their own over the next 6 to 12 months. Vendors that do not invest in this capability are taking on risk that will eventually manifest as breaches. A single vendor breach affecting thousands of marketing customers simultaneously has not yet happened at major scale; it is now a more plausible scenario than it was 18 months ago.

CISA KEV as Legal Liability Standard

CISA’s Known Exploited Vulnerabilities catalog is already de facto regulatory guidance for U.S. federal agencies and is increasingly cited in private sector breach litigation. Over the next 6 to 12 months, watch for state attorneys general and federal regulators to explicitly reference KEV status in enforcement actions — establishing a clear legal standard where failure to patch a KEV-listed vulnerability prior to a breach demonstrates negligence. Marketing organizations that maintain documented records of their KEV monitoring process and patch response timelines will have defensible audit trails. Those without documented processes will not.

AI-Versus-AI Threat Dynamics in Marketing Platforms

Google’s M-Trends 2026 documented malware families (PROMPTFLUX, PROMPTSTEAL) that query large language models in real time during execution to adapt their evasion behavior. QUIETVAULT credential-stealing malware specifically targets machines running local AI command-line tools. As marketing platforms integrate more AI functionality — AI-generated copy, AI-powered audience segmentation, LLM-based recommendation engines — those systems become simultaneously more capable and more complex attack surfaces. The security architecture of AI-integrated marketing platforms will need to account for AI-specific threat vectors that traditional perimeter and endpoint security models did not anticipate.

Bottom Line

Claude Mythos demonstrated that the “margin of safety” the enterprise security industry relied on since the 2024 UIUC research is gone. With Mythos-class models autonomously discovering vulnerabilities without CVE descriptions, and with documented exploitation timelines of under 10 hours on high-severity CVEs, the patching window that enterprise processes were calibrated around no longer exists as a reliable buffer. Google’s M-Trends 2026 puts the hardest number on the new reality: mean time to exploit is negative seven days, meaning organizations are frequently already exposed before a patch is publicly available. For marketing organizations running martech stacks full of customer PII, ad spend credentials, and AI-integrated tools, the practical path forward requires marketing leaders to take an active role in security posture — sponsoring tiered patching policies, implementing the CISA KEV triage framework, building security SLAs into vendor contracts, and deploying real-time anomaly monitoring across high-risk systems. The organizations that have already restructured their security cadence in response to this shift — Mozilla on weekly releases, Oracle on monthly criticals, Chrome at 4x patch volume — are telling you exactly what the new normal looks like. The organizations that treat this as someone else’s problem will learn the hard way that in the current threat environment, the attacker’s timeline is measured in hours and the consequences land in marketing.