The Day-Zero Normal: a CISO brief on reprioritizing security for AI-speed exploits

In two minutes

• The core claim: attackers now build working exploits in hours to days, while patching still takes weeks, so programs should assume breach and invest in containment over faster patching (p. 3).
• A one-page table (p. 4) marks programs to divest (annual pentest, rules-based SIEM, SAST/DAST queues, TPRM questionnaires, annual training), reprioritize (asset inventory, segmentation, phishing-resistant MFA, detection earlier in the kill chain) and add (VulnOps, agent identity governance).
• GOVERN is treated as the most underinvested function; the author proposes a Standing Authority Matrix of small, reversible machine-speed actions, each with a named approver and rollback path (pp. 5, 25-26).
• PROTECT gets the most detail: runtime-validated asset graphs joined to identity, FIDO2 for all privileged accounts, east-west and identity segmentation, egress deny-by-default, an LLM in the pull-request path, and a dedicated VulnOps team (pp. 7-13).
• Other moves include a two-tier endpoint model with Chromebooks for many staff, killing the VPN, ephemeral dev environments, just-in-time admin access, canary tokens, and time-to-rebuild under 4 hours for tier-1 services (pp. 15-20).
• The brief also covers staffing, using cyber insurance questionnaires to win board budget, a 12-week action plan (p. 23), a four-sentence board message (p. 24) and a ten-metric KPI scorecard (p. 28).
• Page 5 warns that some divest items conflict with PCI DSS, HIPAA, SOX, NYDFS and DORA, and suggests ways to map replacement controls onto the required activity, with auditor agreement.

Key numbers

• 40 CVEs, including 28 Firefox bugs rated 8.8 or higher: CVEs credited to Anthropic-affiliated researchers using Claude as of mid-April 2026, per VulnCheck (p. 3).
• 45 to 1: ratio of non-human identities to human users, citing CyberArk 2024 (pp. 6-7).
• $400K-$1.2M/year plus two FTEs: stated cost of a CAASM deployment at Fortune 500 scale (p. 9).
• $50-$150 per privileged user: stated cost of hardware keys for phishing-resistant MFA (p. 11).
• $100K-$200K plus two FTEs: stated first-year VulnOps cost for a mid-to-large enterprise (p. 13).
• 3,000+ fixes across 1,000+ open-source projects: critical and high-severity fixes OpenAI reports Codex Security has contributed to (p. 12).
• 40%: SIEM spend cut the author says most organizations can reach by moving the log lake and dropping the rules engine (p. 18).
• Under 4 hours: target time to rebuild tier-1 services, rehearsed quarterly (p. 20).

What to do with it

• Draft a Standing Authority Matrix of single-scope, reversible actions and get your GC and CIO to sign it within the first 30 days (pp. 6, 23, 26).
• Build a runtime-sourced asset graph joined to identity so you can answer what a compromised token can reach, and add agents, MCP servers and model endpoints as asset classes (p. 8).
• Move 100% of privileged accounts to FIDO2 or passkeys, start egress filtering in one segment, and pilot an LLM reviewer in one codebase's PR path (pp. 11, 23).
• Add identity-layer detection, canary tokens and agent behavioral baselines, and run a quarterly tabletop with an agent-compromise scenario (pp. 18-19).
• Before decommissioning any control, check the regulatory note on p. 5 and take evidence of equivalence to your auditor.
• Ask your broker for the 2026 insurance questionnaires from your top three markets and compare them with your program before the board meeting (p. 22).

Read the full document if

• you need a concrete list of what to deprioritize, fund or add as AI speeds up exploitation.
• you must brief your board or insurer and want ready wording, a 90-day plan and a KPI table.
• you run AppSec, IAM or OT and want the detailed recommendations for those areas.

What it relies on

The brief rests on the author's twenty-five years on the offensive side of security and his experience as a Fortune 500 security VP and chair of the Vulnerability Management Research Group (pp. 1, 3). Two reviewers are named on the cover. It cites a few outside sources: VulnCheck on Claude-credited CVEs, CyberArk on the non-human identity ratio, and OpenAI on Trusted Access and Codex Security. It also cites a SANS 2026 workforce survey. It states no sample, method or original dataset, and the budget figures and targets are given without sources. The document names many vendors by product but does not say what init 6 sells.

Our read

Useful as a prioritization checklist and a source of board and audit talking points. It is an opinionated practitioner view, not a study. Budget figures, targets and claims such as a 90%+ drop in endpoint attack surface are stated without sources. Treat them as starting points to test against your own data. The regulated-industry note on p. 5 deserves a careful read.