The Patch Gap: Why Defenders Need to Think in Chains, Not Checklists

Executive summary: The report warns that rapid, AI-enabled vulnerability discovery combined with shrinking time-to-exploit and slow remediation cycles creates systemic risk—thousands of high-severity flaws (many unpatched) will cascade into enterprises. It highlights an observed exploit campaign (Operation Lunar Peek) that bypassed higher-scored CVEs to compromise 2,000 firewalls, argues CVSS-first patching is insufficient, and recommends graph-based attack-path modeling and choke-point (minimum vertex cut) remediation to reduce immediate risk and buy time for broader patching.