# Buying more time to patch: Making vulnerabilities harder to exploit

Adithya M., Product Manager, ManageEngine

![date](https://www.manageengine.com/ems/images/icon/calender-icon-1.svg) Nov 5, 2026

![Zero Trust access, compensating controls, and faster patching to narrow the exploitation window.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/buying-more-time-to-patch-banner-image.jpg)

The recent PHP2Shell vulnerabilities highlight how difficult it is for organizations to keep pace with vulnerabilities that can be rapidly turned into working exploits. When such a vulnerability shows up in an open-source component widely used across applications and products, remediation takes time because multiple products and dependencies are involved.

Consider the typical remediation process. When a vulnerability affects a third-party product, the vendor must identify it, develop a fix, and release a patch. The organization must then obtain it, test it, and deploy it to the affected systems. If the vulnerability is found in a custom-built internal application, such as an organization's ERP system, the responsibility for developing and deploying the fix falls on the application owners.

In critical environments, the patch may need to pass user acceptance testing before it reaches production. Even under ideal circumstances, this process can take a day. Yet a more realistic scenario can stretch into weeks. A 2025 study published at the IEEE Symposium on Security and Privacy found that required enterprise patching took a median of 13.2 days, with only 32.4% of cases completed within a week.

This challenge is becoming more pronounced day by day. With frontier AI capabilities, attackers can accelerate vulnerability discovery and exploit development. This includes identifying previously unknown vulnerabilities and developing working exploits, compressing what once took weeks into hours. This puts pressure on defenders to patch faster.

The gap between the speed at which a vulnerability can be exploited and the speed at which an organization can realistically eliminate it is huge. Bridging this gap requires organizations to do more than accelerate patching. They need ways to buy time while remediation catches up.

To do this, organizations need to change the way they operate. To support a hybrid working model, they have made their internal applications reachable over the internet. The list of applications exposed for this purpose has grown over time. An application exposed to the internet is potentially reachable by anyone on the internet. If there's a vulnerability in one of these applications, the consequences could be significant.

Rather than exposing an internal application directly to the internet, organizations should use Zero Trust network access solutions to route access through a controlled layer that verifies users and devices before allowing connections. By adding access policies, they can limit which users can reach which applications.

This changes the security equation by reducing the number of paths through which an attacker can reach the affected application. This exercise reduces exposure, buying the organization more time to fix the vulnerability.

While cutting off access to the public reduces the attack surface considerably, risks from within the organization still remain. Organizations should apply more targeted controls to reduce the risk of exploitation. Where the exploit pattern is understood, traffic inspection and filtering controls may be used to block requests associated with the pattern.

For example, if a vulnerability affects a particular application path that only administrators need to access, an organization can restrict that path to the relevant administrative group. If a vulnerable service is listening on a port that does not need to be exposed externally, a firewall rule could block access to that port. These measures act as compensating controls, mitigating exposure while a permanent fix is pending, without requiring an immediate code change to the vulnerable application.

An effective patch management strategy that enables quick patching is critical. However, that alone is not sufficient because a patch is not always available, and operational constraints often prevent immediate deployment. A more resilient cyberdefense strategy is built to compensate for the fact that remediation takes time. It combines timely patching with restricted access, traffic-level mitigations, and policies that limit unnecessary exposure. The goal is to make vulnerabilities harder to exploit while organizations work towards patching them.

## Related Stories

- Patch Management: [Lessons from PHP2Shell: Why waiting for confirmed exploitation is no longer an option](https://www.manageengine.com/products/desktop-central/endpoint-edge/lessons-from-php2shell-patching-before-exploitation.html)
- Vulnerability Management: [When you can't patch: A practical guide to interim mitigation](https://www.manageengine.com/products/desktop-central/endpoint-edge/interim-mitigation-workflow.html)
- Endpoint Security: [The Economics of an exploit has officially collapsed](https://www.manageengine.com/products/desktop-central/endpoint-edge/zero-cost-exploit-economics.html)

## More on enterprise security

### Beyond the Friedman Doctrine: redefining business

**STRATEGY** · 7 min read

Why profits keep widening the trust gap — and what a new doctrine demands of corporate America.

Vethika Kumar · Mar 22, 2026

### How CISOs can become AI-risk advisors

**SECURITY OPERATIONS** · 6 min read

Boards expect the CISO to be the calm voice on AI risk — here's how to step into the role.

Linus Sweeney · Mar 14, 2026

### What is an agentic SOC and why organizations need it

**AI & SECURITY** · 8 min read

Autonomous threat-triage agents are reshaping the security operations center — what changes for analysts.

Anika Roberts · Mar 8, 2026