The Welcome End of an Era

In May 2026, Verizon published the nineteenth edition of its Data Breach Investigations Report, and for the first time in the series' history, the exploitation of software vulnerabilities was the leading initial access vector in confirmed breaches. It accounted for 31 percent of breaches, up from 20 percent the prior year, a 55 percent increase in a single reporting cycle. Credential abuse, which had led the previous edition and which most enterprise security programs have spent a decade organizing themselves around, fell to 13 percent [1].

The same report showed the defensive side moving in the opposite direction. Only 26 percent of vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog were fully remediated during the period, down from 38 percent the year before. The median time to full resolution rose from 32 days to 43. In the median case, organizations faced 50 percent more critical vulnerabilities than the prior year, and the raw count of open vulnerability instances climbed roughly eightfold. Exploitation accelerated, remediation decelerated, and the volume requiring remediation grew.

The obvious explanation is artificial intelligence, and the obvious explanation is wrong, or at least premature. The data underlying that report covers incidents between November 2024 and October 2025, which predates the arrival of the frontier models now capable of autonomous vulnerability discovery at scale. Whatever caused the exploitation surge and the remediation collapse, it was not AI-assisted vulnerability research, because that capability had not yet been deployed at the volume that would show up in this data. The traditional model of enterprise vulnerability management was already failing on its own terms before the technology that will stress it further arrived.

That sequence points toward a thesis somewhat different from the one usually offered. The common framing holds that AI has made attackers more capable and that defenders must therefore run faster. That framing is not false, but it is shallow. It treats AI as a quantitative change in adversary speed, when what the evidence actually shows is a qualitative change in what defensive tooling can be relied upon to do. Nearly every major control in the enterprise security stack encodes an assumption about attacker cost, attacker skill, or attacker speed. Severity ratings assume that exploit development is hard. Patch cadences assume that weaponizing a disclosed vulnerability takes expert-weeks. Email filtering assumes that mass-produced deception looks mass-produced. Fraud controls assume that an outsider cannot convincingly participate in the organization's own business processes. Each of those assumptions was reasonable when it was encoded. Each is now being invalidated, and the tools built on them do not fail loudly when their premises expire. They continue operating, producing outputs that look correct, while the thing they were measuring quietly stops being the thing that matters.

A metaphor that circulates in the security community in several variants captures how the operating logic of enterprise defense has shifted under this pressure. The cast changes with the telling: zebras and hyenas in one version, zebras or antelope and lions in others, two campers and a bear in the joke form most people encounter first [2]. The structure never changes. The prey does not need to be the fastest of its kind, only not the slowest, because the predator's appetite will be satisfied before the faster animals are reached.

Applied to cybersecurity, the metaphor described a market for adversary attention: the attackers would exhaust their capacity on the weakest targets, and any organization that had invested enough to look harder than its peers would be passed over. The resulting posture is one of comparative sufficiency, meaning a defensive standard judged adequate by reference to peers rather than by reference to the adversary. It has been employed in executive suites and embedded in how programs are funded, benchmarked, and defended to boards. It is worth being precise about what comparative sufficiency actually purchases, because the metaphor is polite about it. What relative hardness buys is not protection but displacement: the adversary's effort moves to a softer target. The strategy succeeds only when someone else is breached instead, and it was tenable only while adversary capacity was scarce enough for displacement to be real. It assumed a bounded population of capable attackers and a bounded capacity for parallel operation. Both boundaries have moved, and the paper returns to this framing in its conclusion, because the criterion for survival in an environment where the predators have industrialized is not comparative sufficiency. It is absolute adequacy against the adversary, and absolute adequacy is a completeness standard that partial defensive postures do not meet.

What follows examines the breach record as it now stands, the adversary economy that industrialized before AI arrived and was therefore positioned to absorb it immediately, the four assumptions that AI has invalidated and the tools built on each, the inversion in which vulnerability discovery has outrun the human capacity to remediate, and the two compromises through which enterprise security became partial by design. The argument is not that defense is hopeless. It is that defensive postures must now become comprehensive, and that acceptance of partial protection is no longer an option.

The 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed breaches across 145 countries, drawn from incidents occurring between November 2024 and October 2025. Its headline finding is the reordering of initial access vectors. Exploitation of vulnerabilities reached 31 percent, its first appearance at the top of the ranking in the report's nineteen-year history. Phishing accounted for 16 percent, credential abuse for 13 percent, and pretexting for 6 percent. Beyond the initial access vectors, ransomware appeared in 48 percent of breaches, up from 44 percent. The human element remained present, appearing in 62 percent of breaches [1].

The reordering is less dramatic than it first appears. Verizon tracks identity-related initial access across three separate categories, and phishing, credential abuse, and pretexting together account for 35 percent, which exceeds the vulnerability exploitation figure. The headline comparison of 31 percent against 13 percent sets a consolidated category against a fragmented one. Identity-based access has not receded; it has been outpaced by a category that grew faster [3].

What is not ambiguous is the remediation picture. The proportion of KEV-listed vulnerabilities fully remediated fell to 26 percent from 38 percent. Median time to full resolution rose to 43 days from 32, an increase of roughly a third. Organizations in the median case confronted 50 percent more critical vulnerabilities than in the prior period. Open vulnerability instances rose eightfold [1]. These are not the numbers of a discipline that is holding steady under pressure. They describe a function that is being overwhelmed, and they describe it in a period before the AI capabilities that will overwhelm it further had been deployed.

The report's treatment of artificial intelligence is more restrained than most industry commentary, and more useful for it. Verizon collaborated with Anthropic's Safeguards Team to analyze 793 threat actors who received enforcement action for violating acceptable use policy between March 2025 and February 2026. In the median case, an actor sought AI assistance across roughly 15 distinct MITRE ATT&CK techniques. Regarding AI-assisted initial access specifically, 44 percent mapped to phishing and 32 percent to exploiting vulnerabilities. Fewer than 2.5 percent of the techniques observed were classified as rare [3], [4].

That last figure is the important one, and it cuts against the more excitable readings of AI in offensive security. The picture it describes is not one of adversaries inventing novel attack classes. It is one of adversaries applying AI to the techniques they already used, across more of the attack chain, at greater speed and volume. AI is currently functioning as an operational multiplier on known tradecraft rather than as a generator of unknown tradecraft. This is consistent with what the rest of the breach record shows, and it should temper any claim that the threat landscape has been transformed into something unrecognizable.

It should not, however, be read as reassurance. If AI were producing novel attack techniques, the defensive response would be to develop detection for those techniques. What the data shows is AI being applied to techniques the industry has known about for decades and has repeatedly failed to close. Multiplying the throughput of a known attack against a control that was already only partially deployed does not create a new problem. It converts a tolerated problem into an untenable one, which is harder to fix, because the remedy is not a new detection capability but the completion of work that was deliberately left incomplete. In many cases comparative sufficiency is what made those controls tolerable in the first place: they were left incomplete deliberately, because peer comparison suggested incompleteness was survivable.

The adversary economy that received these AI capabilities was not a loose community of individual operators. It was an industry, already organized and relatively efficient, and its structure explains why AI capability was absorbed so quickly and distributed so widely. Understanding that structure is necessary before assessing what AI changed, because the answer depends heavily on what was already in place.

The defining structural development of the past decade is the separation of the attack lifecycle into discrete, tradeable functions performed by specialists who need not know one another, trust one another beyond the terms of a transaction, or share any objective beyond completing an exchange. The clearest expression is the ransomware-as-a-service affiliate model. A developer team builds and maintains the platform, comprising the encryption tooling, payment and decryption infrastructure, negotiation portal, and leak site, but conducts no intrusions. Affiliates conduct the intrusions and deploy the payload, typically retaining sixty to eighty percent of the ransom. LockBit, the most active group by victim count from 2022 through early 2024, operated on this model with 194 affiliates documented in records seized during Operation Cronos in February 2024 [5].

This observation has a scholarly pedigree that predates the current threat landscape by a decade, and it is worth acknowledging directly, because it clarifies what is and is not new. In 2015, Kurt Thomas and nine co-authors spanning academia and industry, publishing at the Workshop on the Economics of Information Security, systematized the research community's understanding of the underground economy, describing internet crime as already dependent on “a loose federation of specialists” selling capabilities, services, and resources purpose-built for abuse, from which criminal entrepreneurs could assemble complete operations out of individually purchased components [6]. The same work proposed a taxonomy that remains the most useful frame for reading this market: profit centers, the activities that extract wealth from victims, and support centers, the suppliers of tooling, infrastructure, and services on which the profit centers depend. The sociologist Jonathan Lusthaus, approaching the same phenomenon through more than two hundred interviews conducted across the world's cybercrime hotspots, reached a converging conclusion in his 2018 study titled “Industry of Anonymity”, showing how cybercrime had matured into an organized, profit-driven, globally interconnected industry, long past the era of the lone actor [7], [8].

The separation of development from deployment created a secondary market for access. If the affiliate's comparative advantage is intrusion rather than tooling construction, the affiliate's bottleneck becomes the cost and time of obtaining initial access. The market's answer was the initial access broker, an actor who specializes exclusively in obtaining, documenting, and selling authenticated access without deploying any payload. Broker activity roughly doubled between 2023 and 2024, and the pricing tells the story of a maturing market: the average price of a verified network access listing fell from approximately $3,066 to $1,295, a decline of about 60 percent, with 65 percent of listings priced under $2,000 [9]. Supply expanded faster than demand.

Beneath the brokers sits the credential supply chain. Threat intelligence research covering 2024 documented the compromise of approximately 3.9 billion credentials from 4.3 million infected devices, with the top three malware-as-a-service families, Lumma, StealC, and RedLine, together responsible for more than 75 percent of infections [10]. Each operates as a subscription service through Telegram channels, priced from roughly $250 monthly for entry tiers to $1,000 for premium features such as session cookie restoration. The share of infostealer infections exposing enterprise single sign-on credentials rose from 6 percent at the start of 2024 to 16 percent in 2025, and the median interval between a personal device infection and that credential's appearance in an enterprise breach compressed to roughly seven days [11]. The Snowflake campaign of 2024, in which UNC5537 accessed the cloud environments of approximately 165 organizations, illustrates the chain in operation [12]. The credentials were not stolen by the actor who used them. They were harvested by commodity malware, aggregated through dark-web channels, and acquired in a market transaction. The distance between credential theft and enterprise breach was not technical. It was a price.

What this economy has built, under years of law enforcement pressure, is not merely capability but resilience. Operation Cronos, coordinated across ten countries in February 2024, seized 34 servers, closed 14,000 affiliate accounts, froze 200 cryptocurrency wallets, and recovered more than 1,000 decryption keys, and the UK's National Crime Agency repurposed LockBit's own leak site to publish the operation's details [5]. Within days, LockBit's administrator had posted from a reconstituted site and resumed recruiting. Within weeks, new victims were appearing. Chainalysis recorded ransomware payments falling from $1.25 billion in 2023 to approximately $814 million in 2024, the first annual decline since 2022 [13], but the number of distinct data leak sites grew rather than shrank, with 56 new sites appearing in 2024, more than double the prior year [14]. Affiliates migrated to RansomHub, BlackSuit, and Akira. The market redistributed share, but it did not reduce volume.

That resilience is structural rather than accidental. The platform developer, the affiliate, the access broker, the infostealer operator, and the laundering service are separate entities with no organizational dependency beyond discrete transactions. Dismantling one node eliminates that node and not the market relationship it served, because other nodes exist to fill it. ALPHV exited under FBI pressure and affiliates moved on. RedLine was disrupted through Operation Magnus in October 2024, and Lumma absorbed the displaced volume, with detections rising 369 percent between the first and second halves of that year [15].

This is the system that has received AI capability, and its structure determined the reception. A modular market with low barriers to entry, subscription distribution already in place, and a population of participants selected for willingness to adopt whatever tool improves margin does not deliberate about new capability. It prices it and resells it. When the underground began packaging malicious language models, the distribution infrastructure already existed. WormGPT surfaced in mid-2023 as a stripped-down derivative trained on malware-related data, and it was followed within weeks by imitators, then shut down under pressure that August. Variants built on Mixtral and Grok appeared on BreachForums between October 2024 and February 2025, priced from roughly $110 monthly to $5,400 for private versions, and a fourth iteration surfaced in September 2025 [16]. One Cambodia-based marketplace later sanctioned by the U.S. Treasury recorded year-over-year growth in AI service vendor revenue of approximately 1,900 percent during 2024 [17]. None of this required the adversary economy to reorganize. It required only that a new category of product be listed.

Security controls are not neutral instruments. Each one encodes a model of the adversary, and that model contains estimates of what an attack costs, what skill it requires, and how long it takes. Those estimates are rarely stated explicitly and almost never revisited, because they are usually correct for long enough that nobody notices they are assumptions at all. They become the part of the background against which tools are configured, budgets are argued, and risk is accepted.

The difficulty with an expired assumption is that it produces no error message. The control continues to function, its outputs continue to look correct, and the organization continues to rely on them, while the relationship between the output and the reality it was meant to describe quietly dissolves.

The expected consequence of AI-assisted vulnerability discovery was that attackers would find more flaws. The observed consequence, at least so far, is that defenders have found more flaws than they can fix, and that the constraint on software security has moved from one end of the process to the other.

Anthropic states the change directly in its Project Glasswing update: progress on software security used to be limited by how quickly new vulnerabilities could be found, and is now limited by how quickly they can be verified, disclosed, and patched [26]. That sentence describes a reversal of the discipline's organizing constraint, and the operational evidence behind it is unusually candid for a vendor publication.

Of the high- or critical-severity vulnerabilities Anthropic disclosed to open-source maintainers, 530 had been reported at the time of the update and 75 had been patched, with 65 receiving public advisories. A further 827 confirmed vulnerabilities were awaiting disclosure. The average time to patch a high- or critical-severity finding was two weeks. Several maintainers reported being severely capacity constrained, and some asked Anthropic to slow its rate of disclosure because they needed more time to design patches. Anthropic acknowledges that even at a deliberately restrained pace, the effort is adding to an already overloaded security ecosystem [26].

The dynamic compounds because maintainers were already absorbing a deluge of low-quality AI-generated bug reports from other sources, which raises the cost of triaging any individual report and lowers the credibility of the queue as a whole. Anthropic's own triage process involves reproducing each finding, reassessing severity, checking for existing fixes, and writing a detailed report, performed either internally or by one of six external security research firms. That is substantial human effort applied to each item, and it is the reason the disclosure pipeline narrows so sharply at each stage.

The commercial side shows the same shape from a different angle. Following Glasswing, the most recent Palo Alto Networks release included over five times the usual number of patches. Microsoft reported that the number of new patches it releases would continue trending larger for some time. Oracle reported finding and fixing vulnerabilities multiple times faster than before [26]. These are the outputs of vendors who have adopted the capability. Each of those patches must then be tested, distributed, and applied by every downstream organization running the software, and the volume arriving at that end of the pipeline is set by the vendors' new discovery rate rather than by the customers' absorption capacity.

Placed beside the DBIR figures, the two datasets describe one phenomenon measured from opposite ends. Anthropic reports discovery outrunning remediation at the source. Verizon reports open vulnerability instances rising eightfold and the proportion of KEV-listed vulnerabilities remediated falling from 38 percent to 26 percent at the destination [1]. The volume that maintainers and vendors cannot patch quickly enough becomes the backlog that enterprises cannot remediate quickly enough, and the interval during which a disclosed vulnerability is known but unfixed is the interval in which N-hour exploitation operates.

This does not mean AI-assisted vulnerability discovery is net harmful. Anthropic's stated purpose in Project Glasswing is to secure critical software before comparable models can be turned against it, and the wolfSSL finding alone, an exploitable certificate forgery flaw in a cryptographic library used by billions of devices, is the kind of result that justifies the effort. Nor does it mean the defensive side is losing a race, since the first substantial deployment of this capability was defensive by design. What it means is narrower and more actionable: the bottleneck has moved, and an industry whose processes, staffing, and disclosure conventions were all designed around the old bottleneck is now organized against the wrong constraint.

Enterprise security is incomplete by design, and the design was not accidental. Two long-standing compromises produced it. The first is internal to the enterprise and governs how much of the known vulnerability population is actually remediated. The second is external and governs how much responsibility the producers of vulnerable software bear for the defects they ship. Both were rational adaptations to real constraints. Neither survives the current conditions and threat landscape.

Two objections to the foregoing deserve direct answers. The first is that defenders benefit from artificial intelligence as well, and that the asymmetry described is therefore temporary. The second is that enterprises could remediate more aggressively if they chose to, and that the negotiated percentage reflects preference rather than constraint. Both objections contain some truth, yet neither survives contact with how enterprise security actually operates.

On the first: defensive AI capability is real and improving. AI-assisted detection, anomaly analysis in authentication and session behavior, automated triage of phishing content, and AI-augmented security operations all represent genuine gains, and Anthropic's release of Claude Security in public beta, through which Claude Opus 4.7 was used to patch more than 2,100 vulnerabilities in three weeks, demonstrates that defensive application is not hypothetical. Notably, enterprises fixing their own code moved considerably faster than the open-source disclosure pipeline, precisely because they were not waiting on volunteer maintainers working through coordinated disclosure [26].

The asymmetry is not about which side has better technology. It is about deployment velocity and prerequisite conditions. An adversary acquires capability at the speed of a transaction: a tool is listed, a subscription is purchased, and the capability is operational in the same session. An enterprise acquires capability at the speed of a procurement cycle, comprising vendor evaluation, proof of concept, contract negotiation, security review, deployment, integration with the existing stack, and tuning against the environment's specific baseline. The tool that produces security value is not the one that passes the proof of concept. It is the one that has been tuned and integrated and is operated by analysts who understand both its outputs and its failure modes, a state reached twelve to eighteen months after the decision, even in efficient implementations.

The prerequisite problem is more binding still. The most promising defensive application of AI to the access and session problem is behavioral detection, identifying anomalous session behavior, unusual authentication patterns, and activity inconsistent with established baselines. That capability requires continuous visibility across all authentication contexts in the environment, which is often a multi-year instrumentation program governed by the same budget cycle as everything else. The AI layer cannot be deployed before the foundation exists. Offensive capability carries no equivalent prerequisite.

Beneath these sits an asymmetry that receives almost no attention and may be the most consequential in practice: the attacker is permitted to fail during tuning in a way the defender is not. When an attacker tunes a campaign or a payload and it fails, the cost of failure is the attempt. There is no collateral consequence. When a defender tunes a detection system, adjusting an anomaly threshold or tightening the conditions under which access is challenged, the feedback environment is entirely different. The defender can never confirm that a configuration which has not been penetrated is correct, because the attacks it has not seen are by definition the ones its current tuning does not catch. Failure in the other direction, however, is loud. A false positive that blocks a legitimate user produces immediate escalation, a wave of support tickets, a conversation with a business unit leader, and sometimes a direct instruction to roll back the change. Security teams learn through repetition that aggressive tuning invites organizational conflict that can exceed the response to a security gap. The rational adaptation is to tune conservatively. The attacker iterates toward the threshold aggressively because overshooting costs another attempt. The defender retreats from it cautiously because overshooting costs organizational capital that the security team, not the attacker, must spend.

On the second objection, that enterprises could simply remediate more if they chose: the constraint is partly structural and partly temporal, and both parts are real. The staffing dimension is the more durable. The ISC2 Cybersecurity Workforce Study reported a global shortage approaching 4.8 million professionals as of 2024 [32]. The 2025 study, surveying 16,029 practitioners, declined for the first time to publish a single aggregate gap figure, citing instead the rise of skills shortages, particularly in AI and cloud security, as a more precise diagnosis. Fifty-nine percent of respondents identified critical or significant skills gaps within their teams, up from 44 percent the prior year, and 41 percent identified AI as the single most pressing skill need. Thirty-three percent reported their organization lacked sufficient resources to staff adequately and 29 percent reported being unable to afford personnel with the skills required [33].

However, many organizations do not even get to the point of attempting to fill the roles needed to address the threats they face. The temporal constraint is the organization’s budget cycle. Enterprise security allocates capital annually, through a planning process beginning months before the fiscal year it governs, against a threat landscape that will have changed by the time the money is spent. An investment identified as necessary in one year's third quarter enters planning in the fourth, receives approval if it does in the following year's first quarter, enters procurement in the second, completes vendor selection in the third, and begins deployment in the fourth. Before the first analyst is onboarded, the organization has operated with the gap for over a year. This is not a dysfunctional process but a normal one, reflecting the governance obligations and coordination requirements that large enterprises operate under by design.

There is also a frozen window between the close of one fiscal year and formal approval of the next during which no new spending commitment can be initiated, rarely less than a month and often longer where board ratification is required. During that interval a security team identifying an emerging threat or a newly exploited vulnerability cannot initiate the investment that would address it. The machinery is stopped and the threat is not.

This assumes the best case in staffing enterprise security teams. It assumes the organization is willing to staff that team at levels needed to address the current threat environment. But in practice, organizations often treat requests for additional personnel as a variance from the current baseline. A company could support a small percentage increase in the overall size of the enterprise security team, but requests that would significantly increase the size of the team to meet the new threat environment are treated as unreasonable and dismissed out of hand. As a result the company may be staffed for a threat environment that existed years or even decades ago. In many cases, these budgeting and staffing levels of enterprise security teams were originally set based on assumptions of comparative sufficiency.

The governance properties that make a large enterprise trustworthy, its deliberate capital allocation, its audit trails, its change management discipline, and its accountability structures, are the same properties that make it slower than the economy arrayed against it. The adversary economy has no audit committee, no change advisory board, no procurement regulation, and no fiscal year. What the enterprise built over decades to ensure it is well governed is, from the security function's perspective, also a set of constraints its adversary does not share and has learned to exploit.

The zebra and hyena framing introduced at the outset has passed through three stages, and each has a specific relationship to the evidence assembled here.

In the first stage, the security posture required of an enterprise was to be a harder target than the weakest of its peers. The adversary population was bounded, its capacity for parallel operation was bounded, and an organization that had invested enough to distinguish itself from the softest targets would in practice be passed over. Investment was calibrated against peer benchmarks and maturity assessments compared organizations to their industries. The implicit assumption was that adversary attention was a scarce resource that could be diverted.

In the second stage, which the industrialization documented in Section III produced, the threshold rose. The population of capable attackers grew large enough, and the capacity for parallel operation broad enough through affiliate and brokerage structures, that being harder than one's immediate peers was no longer sufficient. The revised formulation was that an enterprise needed to be harder than enough of its peers to satisfy the aggregate appetite of the adversary economy before that appetite reached it. The organizing principle had not changed; the enterprise still needed only to be harder than someone else. But the population of someone else had grown and confidence in sitting above the threshold had eroded.

In the third stage, which the evidence in this paper describes, the framing collapses. When exploit development no longer requires scarce expertise, when convincing deception no longer trades off against volume, when an adversary can learn an organization's own processes well enough to have it authorize the attack itself, and when vulnerability discovery is passing out of the bounds of human research capacity, the assumption that adversary attention is scarce and divertible no longer holds. Capacity sufficient to reach every target of interest, in parallel, on a continuous basis, is the condition the four assumptions were all protecting against, and each of them has now failed. Being harder than one's peers no longer determines whether one is reached, because there is nowhere left to displace the attack to. When capacity is sufficient to reach every target in parallel, the softer target is not visited instead of the harder one. It is visited as well. The only remaining question is whether the defensive posture in place at the moment of contact is adequate against the adversary that arrives. Comparative sufficiency has stopped being a strategy and become a description of how an organization happens to rank while being breached alongside its peers.

Absolute adequacy is a completeness standard, and completeness is precisely what the two compromises negotiated away. Partial completion has been the operating assumption of enterprise defense throughout its history. Multi-factor authentication deployed to most users but not all. Session monitoring built across most authentication contexts but not all. Patching current on most critical assets but not all. Every one of these traded completeness against operational cost on the premise that adversary capacity was bounded and adversary attention was divertible. That premise has expired, and the trade no longer produces the outcome it produced when it was designed. When the adversary economy arrives continuously and in parallel against every reachable surface, the incomplete portion of a defensive posture is not residual risk mitigated by the completed portion. It is the surface through which the intrusion arrives.

For most of the period in which the zebra and hyena logic held, it functioned inside the boardroom as a spending discipline. A board asked to approve a security investment could reasonably ask how the organization's posture compared to its peers, and a favorable comparison offered a defensible reason to hold spending steady. If the organization was not the slowest zebra, the reasoning ran, the marginal investment could wait. This type of comparative sufficiency remains embedded in cyber-risk governance practice today. The most authoritative United States board guidance, the NACD-ISA Director's Handbook on Cyber-Risk Oversight, in its fifth edition published in 2026, still directs boards to ask how significant threats have been to peer organizations, how the organization's control effectiveness compares to industry standards, and how its external vulnerability rating compares to industry benchmarks [34].

The difficulty is not that this guidance is poorly constructed; benchmarking against peers remains genuinely useful for cost discipline and for learning what mature programs look like. The difficulty is that the threat logic which once let a favorable peer comparison double as a spending justification has dissolved. When adversary capacity was bounded and adversary attention was diverted, being harder than one's peers meaningfully reduced the probability of being reached. In the current threat environment it does not. The board that asks what its competitors are doing and takes comfort from a favorable answer is measuring a variable that no longer determines its exposure. The comparison can no longer answer the question that now governs whether the organization is breached, which is not whether its defenses are better than its peers but whether they are adequate, in absolute terms, against an adversary that will arrive regardless of where the organization ranks.

This is not a claim that offense has permanently overtaken defense. The first substantial deployment of frontier vulnerability discovery capability was defensive by design, directed at hardening the software on which the internet depends rather than at attacking it. Thousands of serious vulnerabilities in systemically important code have been found and are being fixed that would otherwise have remained latent, and the defenders who received that capability first genuinely gained an asymmetric advantage. Nor is the situation hopeless. What has happened is that the tools and architectures on which enterprise defense depends were calibrated against assumptions that have expired, that the expiry produces no alarm, and that the compromises which made defense partial by design are no longer survivable.

The response this calls for is not primarily technical. The technical elements, such as continuous session monitoring rather than periodic access review, risk-tiered remediation on the model CISA adopted in Binding Operational Directive 26-04, which scores each vulnerability on exposure, known exploitation, automatability, and impact rather than on severity alone [35], and continuous adversarial testing of controls rather than annual assessment, are all downstream of a governance decision. The decision is to stop treating partial completion as a waypoint on the path to full completion and to recognize it as a defined failure mode with a defined threshold, below which the adversary economy will reach the incomplete portion faster than the enterprise can close it.

The zebras cannot outrun each other any longer, and comparative sufficiency was only ever the practice of hoping they would not have to. The hyenas have industrialized, and the tools that once let a well-run organization judge its own safety by looking sideways at its peers were built on assumptions that no longer hold. What remains is the harder standard: to be, in absolute defensive posture, faster than the hyenas themselves.