U.S. Cybersecurity Pushes Faster Patch Deadlines Amid Rising AI-Driven Threats

U.S. cybersecurity officials are exploring significantly shorter deadlines for fixing critical vulnerabilities in government IT systems, driven by growing concerns that hackers are leveraging advanced artificial intelligence tools to accelerate cyberattacks. According to sources familiar with the discussions, the proposed change would reduce the current response window for actively exploited vulnerabilities from roughly two to three weeks down to just three days.

This potential shift highlights the increasing urgency surrounding AI-powered cybersecurity threats. Newer AI models, including tools like Anthropic’s Mythos and OpenAI’s GPT-5.4-Cyber, are believed to enhance hackers’ ability to detect unknown software weaknesses and exploit newly disclosed vulnerabilities at unprecedented speed. What once took weeks or even months for cybercriminals can now occur within hours, putting immense pressure on defenders to respond more quickly.

The Cybersecurity and Infrastructure Security Agency (CISA), which maintains a catalog of known exploited vulnerabilities (KEVs), has historically given federal civilian agencies several weeks to apply patches. Recently, that timeframe has already been shortened to about two weeks. The latest proposal would make three days the standard deadline, signaling a major shift in federal cybersecurity strategy.

Industry experts agree that faster response times are becoming essential. Stephen Boyer, founder of cybersecurity firm Bitsight, emphasized that the shrinking window for defense requires agencies to act with greater speed and efficiency. Meanwhile, former CISA deputy director Nitin Natarajan noted that such changes could influence not only federal agencies but also state governments and private sector organizations to adopt stricter cybersecurity practices.

However, concerns remain about feasibility. Cybersecurity professionals warn that patching vulnerabilities often requires extensive testing to avoid system disruptions, making a three-day turnaround challenging for complex environments. Additionally, CISA itself has faced staffing and funding constraints, raising questions about whether it has the capacity to support stricter enforcement.

As AI-driven cyber threats continue to evolve, the balance between speed and stability in vulnerability management will become increasingly critical. The proposed changes underscore a broader industry trend toward rapid cybersecurity response as organizations adapt to a more aggressive and technologically advanced threat landscape.