Exploits now take hours while fixes take weeks — a16z maps 6 security startups
a16z · x · 2026-11-07
a16z amplifies asafez's article "Defense in Depth, Rebuilt for Machine Speed": AI can now turn a published patch into a working exploit within hours, while median enterprise patching still takes 43 days (Verizon DBIR 2026) and 26% of 2025 industrial advisories had no fix at all.
The accompanying chart contrasts timescales by layer: AI-assisted exploits in hours, CDN protective rules in under a day, a Linux kernel package still open after 24+ days, 252 days to fix half of application flaws, and unsupported medical devices with 10–20 year service lives.
Core argument: the question isn't how to patch faster, but how to stop needing to. Six startup openings:
- Live fixes: block exploits on running systems within hours, then have AI write and ship the real fix
- AI first responder: detect attacks without hand-written rules and contain them live
- Per-request access: verify every human or agent request with credentials expiring in minutes
- Proven recovery: continuously restore backups in a sealed test environment with insurer-acceptable records
- Install gateway: hold and sandbox every new package
Related event: a16z: AI Weaponizes Vulnerabilities in Hours, Reshaping Cyber Defense(5 posts)→
More from Venture
- Intel CEO: Agentic workloads could 5x server CPU TAM to $200B in 5 years — Beth_Kindig · 2026-11-07
- Apollo: companies now treat AI spending as a margin cost, pulling back — PAstynome · 2026-11-07
- Sebastian Aaltonen's AI-built shooter PETAFAB launches on Steam at $9.99 — lucasmeijer · 2026-11-07
- Ex-ElevenLabs growth lead hits £100K/month in 95 days solo with Claude Code — aakashgupta · 2026-11-07
- AEO founder: AI replacing Google is mythology, but answer boxes are AI now — ramagetime · 2026-11-07
- Elizabeth Yin: a $1K angel check would have made $250K vs fund carry — dunkhippo33 · 2026-11-07