You are not going to win the patching race. AI has seen to that.

Mandiant’s M-Trends 2026 puts the mean time to exploit a vulnerability at an estimated negative seven days. On average, attackers are using a flaw a week before the patch exists. Exploits were the top way in for the sixth straight year, at 32 percent of intrusions. VulnCheck found that 23 percent of known exploited vulnerabilities in the first half of 2026 showed exploitation on or before the day the CVE was published.

Discovery is speeding up too. Palo Alto Networks’ Unit 42 pointed an autonomous research system at 3,915 open source projects. In two months it confirmed 14,090 vulnerabilities, 99.4 percent of them previously unreported and nearly 40 percent rated High or Critical. Attackers have the same class of tools. Expect more flaws, found faster, in software you already run.

Patch faster, yes. But no team patches at negative-seven-day speed, and some systems cannot be patched quickly at all: legacy applications, OT, anything that needs a change window. The better question is this: when a vulnerable system is sitting on your network, who can actually reach it?

That is the question Zero Trust answers. NIST SP 800-207 builds the architecture on one idea: nothing is trusted because of where it sits on the network. Applied well, a missing patch stops being an open door and becomes a locked room that most attackers never find.

Identity-Based Access: No Authorization, No Network Path

In a traditional network, connectivity comes first and authentication second. Anyone who can route to a server can probe it, and that is all a pre-authentication exploit needs.

Zero Trust reverses the order. Users and devices are authenticated and authorized by policy before any connection to the application exists. Applications sit behind a broker, expose no inbound listener to the internet, and are invisible to scanners. An unpatched service that an unauthorized party cannot reach is one that party cannot exploit. Add phishing-resistant MFA and device posture checks, and a stolen password alone does not buy a path either.

Microsegmentation: A Foothold Is Not a Free Pass

Attackers who get in move fast. CrowdStrike measured the average breakout time at 29 minutes. Flat networks make that easy: compromise one workstation and every unpatched server on the VLAN is in range.

Microsegmentation sets east-west traffic to default deny. Each workload talks only to the specific systems and ports it needs, and everything else is dropped. The compromised laptop cannot reach the vulnerable database, because nothing in policy says it should. For legacy and OT systems that may never be patched, a tight segment is the practical compensating control.

Audit Logging: Know Whether the Gap Was Used

When exploitation comes before the patch, every patch cycle raises the same question: did someone get to this system before we fixed it?

Zero Trust sends every access request through a policy decision, so every request can be logged: who, from what device, to which resource, allowed or denied. Sent to a central, tamper-resistant store, those logs let you hunt backward from a new CVE, scope an incident by identity instead of IP address, and spot the spike in denied connections that means someone is testing your segments.

Keep them long enough to matter. Mandiant reports a median dwell time of 122 days for espionage intrusions and recommends retaining logs well past the usual 90 days. Federal teams already have the yardstick in OMB M-21-31.

What Zero Trust Does Not Do

It does not replace patching. Public-facing applications still face the internet. The brokers, gateways, and identity providers that enforce Zero Trust are high-value targets themselves and belong at the front of the patch queue.

What it does is change the math: fewer systems exposed, fewer paths between them, and a record of every attempt. That turns an emergency patch into a scheduled one.

Where to Start

• Take every application that does not need direct internet exposure and put it behind identity-based access. Start with remote access and admin interfaces.
• List what you cannot patch quickly (legacy, OT, vendor-managed) and segment those systems first, default deny.
• Log every access decision centrally, then test one question: who touched this system in the last 120 days?

Want to know how exposed your unpatched systems really are? Book a consultation with Di1.