Exploit Development Was Once the Bottleneck: A 23-Year Data Analysis on AI and the Patch Lag Window

An a16z analysis points out that AI agents have compressed exploit development from weeks to hours or even minutes. The fundamental asymmetry between offense and defense lies in the fact that patch deployment speeds cannot scale exponentially due to physical and operational constraints. Drawing on 23 years of offensive and defensive security data alongside recent attack cases, the piece argues that while systematic catastrophes like total power grid collapses remain unlikely, AI will spark massive disruptions reminiscent of the early worm era—heavily impacting schools, hospitals, SMBs, and industrial facilities unable to patch quickly. With attack costs plummeting, defensive priorities must pivot from merely trying to shorten patch windows to network segmentation and edge protection.