AI Killed the Patching Buffer: Is BAS the Only Hope Left?

Just read the article on HackerNews about how AI has effectively erased the buffer time between vulnerability disclosure and weaponization. It’s a grim reality check. For decades, we relied on the fact that weaponizing a bug took human skill and time. Now, LLMs are churning out PoCs as fast as we can read the CVE description.

We are seeing this stark reality with recent issues like CVE-2026-44963 (Veeam) and CVE-2026-25089 (FortiSandbox). By the time your Monday morning triage meeting starts, automated bots are already hitting your edge with AI-generated exploits.

We’re finally getting budget for a dedicated BAS (Breach and Attack Simulation) platform because traditional quarterly pen-testing is effectively dead. We need continuous validation. I whipped up a quick Python script to poll the CISA KEV catalog and automatically push new critical CVEs into our BAS controller for immediate simulation checks.

import requests

def trigger_simulation_for_critical_vulns():
    # Hypothetical endpoint for CISA KEV
    response = requests.get("https://www.cisa.gov/known-exploited-vulnerabilities-catalog-")
    data = response.()

    for vuln in data['vulnerabilities']:
        # Focus on recent critical vulns to reduce alert fatigue
        if vuln['severity'] == 'Critical' and '2026' in vuln['dateAdded']:
            print(f"Alert: {vuln['cveID']} detected in KEV. Triggering automated BAS chain.")
            # logic to call internal BAS API (e.g., Cortex XSOAR, SafeBreach)
            # subprocess.run(['python', 'bas_trigger.py', '--cve', vuln['cveID']])

if __name__ == "__main__":
    trigger_simulation_for_critical_vulns()


If the AI is automating the offense, we have to automate the defense loops. How are you guys handling the shrink in reaction time? Are you still strictly relying on CVSS scoring for prioritization, or have you moved entirely to exploitability intelligence?