Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.

Vendors have not issued any notices or patches within the traditional 90-day window following recent high-profile security disclosures, signaling a fundamental shift in vulnerability management and threat dynamics.

Since the adoption of the 90-day coordinated disclosure policy, vendors were expected to respond within three months of a vulnerability report. However, recent cases, including the Linux kernel’s Copy Fail bug and breaches at Vercel and Canvas, demonstrate that attackers can now exploit vulnerabilities in real-time, often before patches are publicly available.

The Linux kernel patch for Copy Fail was committed on April 1, 2026, but no vendor or affected organization issued a notice or patch by the end of the 90-day window on June 30, 2026. Meanwhile, AI-driven tools can monitor kernel commits, reverse engineer patches, and develop exploits within minutes—a process that previously took days or weeks.

Experts warn that this shift diminishes the protective advantage historically held by defenders, as attackers can now operate with near real-time intelligence, rendering the traditional 90-day window obsolete. The recent breaches at Vercel (April 19) and Canvas (May 1) further highlight that modern vulnerabilities often reside in trust boundaries, such as OAuth scopes and SaaS integrations, rather than traditional memory safety bugs.

Implications of the Disappearance of the 90-Day Window

The collapse of the 90-day disclosure window marks a new era in cybersecurity, where attackers can rapidly weaponize vulnerabilities before organizations can respond. This shift challenges existing patching and defense strategies, emphasizing the need for proactive monitoring and AI-driven security measures. The trend also raises questions about the future of responsible disclosure and the role of vendors in a landscape where information is exploited almost instantaneously.

Evolving Vulnerability Discovery and Response Practices

The 90-day coordinated disclosure policy, established in the early 2000s and popularized by Google Project Zero in 2014, was based on the assumption that reverse engineering patches takes significant time, allowing defenders to deploy patches before attackers can exploit vulnerabilities publicly. However, recent technological advances, especially in AI, have drastically shortened or eliminated this window.

The April 1, 2026, Linux kernel commit for Copy Fail exemplifies this shift. The patch was public from the moment it was committed, and AI tools could analyze the diff, understand the bug, and develop exploits within minutes. This undermines the core assumptions of the traditional disclosure model and accelerates the threat landscape.

Furthermore, recent breaches at Vercel and Canvas demonstrate that the most critical vulnerabilities now lie in trust boundaries—OAuth permissions, SaaS-to-SaaS integrations, environment variables—areas that are less protected by traditional memory safety defenses.

“The collapse of the 90-day window fundamentally alters the cybersecurity landscape, making real-time exploitation a new norm.”

— Thorsten Meyer

Unresolved Questions About Future Security Practices

It remains unclear how organizations will adapt their security and patching strategies in response to the accelerated threat timeline. The long-term effectiveness of current defenses against AI-enabled exploits is also uncertain, as is the potential for new regulatory or industry standards to emerge.

Next Steps for Security Stakeholders in a Rapid-Exploit Era

Organizations will need to enhance their real-time monitoring capabilities, leverage AI for threat detection, and reconsider traditional patching timelines. Industry and regulators may also explore new frameworks to address the diminished role of the 90-day window, possibly emphasizing proactive defense and zero-trust architectures. Ongoing research and case studies from recent breaches will shape these developments in the coming months.

Key Questions

Why is the 90-day disclosure window no longer effective?

Advances in AI enable exploits to be reconstructed and weaponized within minutes of a patch’s public release, eliminating the buffer period that the 90-day window was designed to provide.

What vulnerabilities are most affected by this shift?

Trust boundary vulnerabilities, such as OAuth scopes, SaaS integrations, and environment-variable handling, are now more critical than traditional memory safety bugs, as they are less protected by existing defenses.

How should organizations respond to this new threat landscape?

Organizations should adopt real-time monitoring, AI-driven threat detection, and zero-trust security models to mitigate risks posed by rapid exploit development.

Will vendors change their disclosure policies?

It is uncertain; some experts suggest new frameworks may be needed, but current practices are unlikely to revert to the traditional 90-day model given the technological realities.

What role will AI play in future cybersecurity efforts?

AI will be both a tool for defenders to detect threats faster and a weapon for attackers to develop exploits more quickly, fundamentally transforming cybersecurity dynamics.

Source: ThorstenMeyerAI.com