The exploit survival curve is the chart that matters. If nothing survives six weeks and the median exploit lands in a day, then every software defence is competing on the same clock as the attacker, and it is a clock software cannot win.
Jenny’s point about buying cycles goes further than incumbency. If procurement takes a quarter and exploitation takes a day, the only defences that hold are the ones that do not need to be re-bought, re-tuned or re-patched per threat. That is a hardware property, not a software one.
We are building exactly that at VISS: a hardware appliance that reduces the endpoint to a pixel stream over an optical air gap, so an attacker who owns the PC has no executable path to the endpoint. Any exploit, any speed, same result: dead end.
Whether the new sheriffs are software platforms or hardware primitives is, I think, the real question behind this chart.
Reading this from the GCC, where we invest behind cyber growth, the procurement point in the comments inverts.
In Saudi, buying is not the binding constraint. National Cybersecurity Authority, Central Bank, and Capital Market Authority (SEC in the US) mandates budget in place ahead of the threat rather than after it, and boards approve on a compliance timetable, not an incident one. What is scarce is people to operate what has been bought, and data residency rules that keep much of the global stack outside the estate.
So the same collapse in exploitation timelines selects for something different here: not the fastest tool, but the one that runs with the fewest hands and lands inside the sovereign boundary.
(On the 87% — the Zero Day Clock was rebuilt after this went out and has retired that metric; its current read is roughly 130 of c.485 for H1.)
The cyber section measures how fast attackers move but not how fast defenders can buy. Exploitation is down to a day. Buying enterprise security software takes a quarter, once you count evaluation, security review, and budget approval. The tool shows up after the window it was bought for has closed.
That's my answer to the question you leave open about incumbents versus new platforms. If a company can only respond as fast as it can purchase, the vendor already installed is the only one that can act in time. Incumbency stops being a sales advantage and becomes the product.
This is an interesting shift from “what skills do you have?” to “what have you actually figured out?”
With AI making specific skills easier to learn and more likely to change, I think the ability to learn, adapt, and figure things out may become the more durable skill.
The exploit survival curve is the chart that matters. If nothing survives six weeks and the median exploit lands in a day, then every software defence is competing on the same clock as the attacker, and it is a clock software cannot win.
Jenny’s point about buying cycles goes further than incumbency. If procurement takes a quarter and exploitation takes a day, the only defences that hold are the ones that do not need to be re-bought, re-tuned or re-patched per threat. That is a hardware property, not a software one.
We are building exactly that at VISS: a hardware appliance that reduces the endpoint to a pixel stream over an optical air gap, so an attacker who owns the PC has no executable path to the endpoint. Any exploit, any speed, same result: dead end.
Whether the new sheriffs are software platforms or hardware primitives is, I think, the real question behind this chart.
Reading this from the GCC, where we invest behind cyber growth, the procurement point in the comments inverts.
In Saudi, buying is not the binding constraint. National Cybersecurity Authority, Central Bank, and Capital Market Authority (SEC in the US) mandates budget in place ahead of the threat rather than after it, and boards approve on a compliance timetable, not an incident one. What is scarce is people to operate what has been bought, and data residency rules that keep much of the global stack outside the estate.
So the same collapse in exploitation timelines selects for something different here: not the fastest tool, but the one that runs with the fewest hands and lands inside the sovereign boundary.
(On the 87% — the Zero Day Clock was rebuilt after this went out and has retired that metric; its current read is roughly 130 of c.485 for H1.)
The cyber section measures how fast attackers move but not how fast defenders can buy. Exploitation is down to a day. Buying enterprise security software takes a quarter, once you count evaluation, security review, and budget approval. The tool shows up after the window it was bought for has closed.
That's my answer to the question you leave open about incumbents versus new platforms. If a company can only respond as fast as it can purchase, the vendor already installed is the only one that can act in time. Incumbency stops being a sales advantage and becomes the product.
This is an interesting shift from “what skills do you have?” to “what have you actually figured out?”
With AI making specific skills easier to learn and more likely to change, I think the ability to learn, adapt, and figure things out may become the more durable skill.
Some great insights especially in data roles
Great Article!