Discovery-Patch Race Glossary
Discovery-Patch Race
The discovery-patch race is the contest between finding a software vulnerability, exploiting it, building a remedy, and deploying that remedy across exposed systems.
Discovery is not the finish line. A defender must validate the flaw, design a patch, test it against breakage, distribute it, and persuade or compel operators to install it. An attacker needs only a workable path into enough unpatched systems.
AI can accelerate both sides. A model that finds flaws at machine speed may shorten the time needed to detect and fix them. It may also enlarge the number of actors able to discover or exploit them. The result depends on the Offense-Defense Balance, the size of the Patch Gap, and the remaining Window of Exposure.
“Who found the bug first?” is therefore the wrong stopping question. The operational question is whether defenders closed the exposure before attackers converted discovery into harm.