"Exploit mitigation" stalled around 2008. The attacks didn't.

This report argues that advances in AI have compressed the window between public patch availability and weaponized exploits from days to hours, citing Anthropic’s demonstration of automated exploit generation and OpenAI’s defensive initiatives. It highlights a structural gap: modern user-mode endpoints largely rely on legacy, opt-in mitigations while powerful mitigations exist but are usually disabled or impractical to deploy; Sophos describes its default-on, OS-depth mitigations (60 protections) as a corrective layer to deny the small set of primitives every attack must use.