Approximately 31 percent of breaches originate from hackers exploiting known vulnerabilities, according to Verizon’s 19th annual Data Breach Investigations Report (DBIR) Often, these known vulnerabilities have patches available, but organizations either fail to deploy them or fail to do so in a timely manner, leaving their networks vulnerable to attack by malicious actors.
Put differently: faster patch deployment alone could prevent nearly one in three breaches. As Daniel Lawson, senior vice-president of global solutions at Verizon Business, explained, “…the foundational principles of security and strong risk management remain the most effective defense.”
AI has made patch management and deployment even more difficult. For IT and cybersecurity professionals at government agencies and education institutions, the tools that defenders once relied on are now being turned against them. AI is effectively enabling malicious actors and advanced persistent threat (APT) groups to reverse-engineer each new security patch as it’s released, allowing them to find vulnerabilities more rapidly than patches can be deployed.
The result: IT and cybersecurity staff at government agencies are essentially bailing water from an actively sinking ship.
Patching in this new era of AI-driven attacks will be one of many topics covered at the upcoming Ivanti Public Sector Summit. To learn more about the challenges agencies face in keeping their networks secure and the new tools available to help protect them, we sat down with Derek Illum, a Senior Solution Engineer for Public Sector at Ivanti, who will be participating in the panel discussion, “Managing Risk Across a Growing Attack Surface.”
During our conversation, Derek explained how AI has compressed the window to exploit known vulnerabilities and shared four pillars of a more effective, modern approach to patch management.
Government Technology Insider (GTI): Why are patch management and patch deployment so important? How often are known software vulnerabilities exploited in cyberattacks?
Derek Illum: Unpatched vulnerabilities are among the most common root causes of breaches. Patching is the remediation engine of modern cyber defense. When vulnerabilities are weaponized quickly, any delay in patch deployment directly translates into greater exposure time and a higher probability of a breach. Patch management is no longer hygiene; it’s front-line risk reduction.
Six years ago, we were driving toward a 14-day Service Level Agreement (SLA). The average release to exploit code availability was 14 to 28 days at that time. With more than 45,000 Common Vulnerabilities and Exposures (CVE) disclosed annually, the median time-to-exploit has now been reduced to five days.
That exploit window is estimated to shrink more by 2027. Traditional patch cycles guided by fragmented data and point-in-time reports can’t keep up, and these are pre [Claude] Mythos numbers.
GTI: Why is it more important than ever to rapidly deploy software patches in the age of AI? How are malicious actors leveraging AI to accelerate and enhance the effectiveness of cyberattacks?
Derek Illum: In an AI-accelerated threat landscape, “patch quickly” becomes “patch continuously at machine speed.” Traditional monthly cycles are structurally too slow to keep up with the number of updates being released. Government agencies have to update their patching operations to keep pace.
AI has collapsed the exploitation window from weeks to days. AI is being used to accelerate discovery and weaponization. LLMs and specialized cyber models can mine code, configurations, and public CVE data to identify exploitable conditions at scale. AI exploit frameworks can rapidly generate, refine, and share working exploits, shrinking the gap between disclosure and active attacks.
GTI: Why are patch management and deployment challenging for today’s public sector organizations? What large trends – staffing shortages, juggling too many modernization initiatives, etc. – impact their ability to manage and deploy patches efficiently?
Derek Illum: Government agencies and education institutions face persistent patch management challenges. Legacy systems and fragmented toolsets drain resources and create blind spots, while ticket-driven workflows produce manual handoffs and coverage gaps. In the public sector, small teams face even greater burdens trying to juggle multiple modernization priorities while adhering to strict compliance mandates.
A large share of assets found with Ivanti’s discovery tool, often 30 percent, are missing from Configuration Management Databases (CMDB). And 73 percent of security leaders report incidents involving unknown or unmanaged devices, making comprehensive remediation impossible. The significant portion of assets missing from CMDBs prevents complete remediation.
The operational constraints — combined with strict Federal Risk and Authorization Management Program (FedRAMP)/National Institute of Standards and Technology (NIST) requirements and an AI-accelerated threat landscape that shortens time to exploit—mean that periodic, manual patch cycles cannot keep pace with today’s risk environment.
GTI: What is a more modern and effective approach to patch deployment and management? How is this different from how patches were traditionally managed and deployed?
Derek Illum: Traditional patching relies on periodic scans and monthly or quarterly maintenance windows, with security and IT coordinating through incident or change tickets. Teams prioritize manually, relying on CVSS scores, spreadsheets, and hours of research and testing. Teams often operate with limited visibility into unmanaged, remote, or offline devices.
Modern patch management delivers continuous scanning and exposure-based compliance, using AI-driven risk prioritization instead of static severity lists. It performs autonomous deployment to remediate missed or offline devices as soon as they reconnect. And runs closed-loop workflows that move from detect to decide to act without manual tickets while still maintaining full governance and reporting.
A more modern and effective approach to patch deployment and management requires four things. The first is a unified system of record. Instead of separate tools for inventory, vulnerability, and patching, public sector organizations need a single, authoritative system of record that combines endpoint inventory, risk, patch state, and compliance posture in a single, unified motion.
Next, it requires continuous discovery and visibility. Government agencies and education institutions should be able to continuously scan for managed devices, unmanaged devices, shadow IT, and cloud workloads. They should be able to reconcile these things into one view to eliminate unknown endpoints falling out of patch scope.
Then, risk-based prioritization is necessary to assess the risk posed by vulnerabilities and set patching priorities. Instead of patching based on CVSS alone or static severity, agencies should be able to evaluate vulnerabilities using the Vulnerability Risk Rating (VRR), which incorporates exploit activity, asset criticality, and real-time threat intelligence to determine what to patch first.
Finally, it requires always-on, autonomous enforcement. This shifts patching from scheduled, manual campaigns to continuous, autonomous remediation that reduces exposure from weeks to hours, with closed-loop verification, drift detection, and audit-ready proof. All with a human in the loop.
GTI: You will be participating in a panel at the upcoming Ivanti Public Sector Summit called “Managing Risk Across a Growing Attack Surface.” What should attendees expect to learn and take away from this session?
Derek Illum: During our session, attendees will learn how public sector organizations can modernize vulnerability management by automating the entire lifecycle, from asset discovery and attack surface mapping to risk-based prioritization and patch deployment.
The session will also explore how automation helps security and IT teams close security gaps faster, reduce operational risk, and improve collaboration across the remediation process.
To learn more and reserve your spot, register for the Ivanti Public Sector Summit.