The Signatories

“AI capability scales with the cheapness of verification. Offense has the cheapest verifier.”

“The entire defense model is built on imposing cost on attackers. AI is about to make that cost zero.”

“The attackers’ AI singularity has arrived. Ours has not yet begun.”

“Google taught me that any machine should be rebuildable in hours. The Clock measures whether you still have hours left.”

“Attacks always get better. They never get worse. But for the first time, the same is true for defense. The race just got faster on both sides — and the side that sees the data first wins.”

“We continue to see threat activity accelerate and the time to exploit availability and exploitation accelerate.”

“Distributed. Immutable. Ephemeral. When exploits arrive in hours, the only system that survives is one built to be replaced.”

“I built DEF CON so researchers could show what they found. For thirty years, I watched the time between finding a vulnerability and exploiting it get shorter. We’re running out of timeline to show.”

“Everything we’re doing in internet security is too little, too late. I’ve known that for decades. What I didn’t know was how fast ‘too late’ would arrive. Now there’s a Clock that measures it.”

“500,000 SANS-trained defenders. The Clock shows the new speed. Now we make every tool they use AI-ready.”

“Less than 5% of vulnerabilities are weaponized and time-to-exploit is already in hours. When AI scales that to 60%, no patch cycle, no SOC, and no budget survives the math.”

“Every patch is an exploit blueprint. AI will dramatically compress the time it takes to turn the blueprint into a working exploit.”

“AI agents are the new attack surface and the new defenders. We must secure both sides.”

“Speed is our best defense. When exploits arrive in hours, the only viable defense is the one that’s already on by default - broad classes of architectural mitigations.”

“When AI collapses the exploit timeline to hours, implicit trust becomes existential risk.”

“MOAK proves what everyone feared. Any threat actor can now use publicly available AI models to weaponize vulnerabilities in minutes.”

“AI finds and exploits vulnerabilities faster than we patch them. We need to focus on eliminating entire bug classes.”

“Every vulnerability scoring framework assumes defenders have time to prioritize. When exploitation is instant, scoring becomes a post-mortem exercise.”

“Security leadership spent decades optimizing calendars. Now, AI hands attackers a stopwatch. Bringing a calendar to a clock fight won’t end with lessons learnt but with a post mortem.”

“Agentic AI is driving toward one-click CVE exploitation. Defenders must accelerate detection and remediation. That’s what this clock represents.”

“We are fighting a war with the bad guys. We can only hope to win this war if we fight it together. Open source is the only approach with the agility and broad reach to meet modern security concerns.”

“There’s no doubt that AI is making attackers’ lives easier, continually lowering the bar to exploit software. That’s exactly why we need to double down on secure-by-design development, particularly in the age of AI coding.”

“The future of security is the dueling banjos of the defender’s AI stack vs. the attacker’s AI stack. And the worse that imbalance is the worse this clock gets.”

“Mythos is cybersecurity's Y2K, except the deadline already passed. When AI finds thousands of zero-days that survived decades of human review, the vulnerability window doesn't shrink. It vanishes.”

“Vendors outsource their quality problems to customers, who build whole organizations just to manage the treadmill. Attackers couldn’t have designed it better.”

“The tipping point always comes faster than you think. I’ve seen it with cloud, AI, and digital assets.”

“When underwriting cyberinsurance and dealing with claims we’re seeing attackers getting faster.”

“Exploits used to be crafted. Now they're manufactured. The barrier to entry isn't skill anymore, it's compute budget and patience. The clock isn't measuring human speed anymore.”

“A strong wake-up call. When weaponization timelines shrink to zero, the traditional "patching grace period" model becomes obsolete. The real answer is better software quality and architectures that reduce exploitable exposure in the first place.”

“Traditional patching is a losing race against the clock. The future of defensive security belongs to autonomous systems.”

“Artificial Intelligence is moving faster than any technology before it. Those who fail to prepare won’t fall behind — they will be left irrelevant.”

“I’ve funded cybersecurity startups for a decade. The companies that win compress the time between vulnerability and fix. The Zero Day Clock measures that compression for the entire ecosystem.”

“I built security teams at Facebook, Uber, and Cloudflare. At every one, the hardest part was the same: creating urgency before the breach, not after.”

“I co-wrote the first web application security testing standard in 2003. Twenty-two years later, cross-site scripting is still the number one vulnerability class. We are not learning. We are accumulating.”

“AI is bringing real speed and scale to defense. Attackers have it too -- but if we move fast, defenders can finally gain an edge. We should all worry about a "vuln-pocalypse," yet act with speed and urgency to secure the world's code. Exciting times!”

“Cybersecurity in the age of AI is a marathon that we need to sprint. The urgency is real.”

“Cybersecurity has always been a matter of time and resources. With AI, both have disappeared.”

“Secure by Design is the only way forward. Hack yourself with the best security bug finders before release.”

“The bar to exploit vulnerabilities is now so low that “break then patch” is not a viable approach anymore.”

“Defenders still live in a pre-AI world. We can now patch at scale with the click of a button, and we need to.”

“Vulnerability exploitation signals have become disrupted and noisy, in an ai era we need automated Response”

“AI will compress SLAs to zero. Quality and defense must become continuous and automatic.”

“RunSybil exists because we saw this convergence coming. Now there's data the whole world can see.”

“I reminded a few people about this back in 2018, AI is going to ruin everyone’s party. That time Is now.”

“We reported 15 critical kernel bugs to 8 vendors. One got patched. PSIRTs aren’t built for AI-scale volume.”

“We are no longer playing cat and mouse. It's just cat now while we are caught with our tails tied.”

“Let’s accept that the exploit window is gone and it isn’t coming back. Then let’s build systems that assume compromise and are designed to keep running through it.”

“In the age of AI, human eyes will no longer spot the bugs that matter.”

“Time has never really been on our side, but we have acted as if it was. We no longer can avoid reality.”

“"We must all hang together, or most assuredly we shall all hang separately".”

“We've got to build systems as if there is always a zero day and the patch is never coming.”

“Process bound defense meets ambition fueled offense. AI adoption demands immediate reconciliation.”

“The Clock has run out. We must equip defenders with the correct tools and incentives, or we will all suffer.”

“The codebase is growing exponentially. We must radically shift to secure languages & practices. In every LoC.”

“Customers don't trust marketing. Smart ones trust auditors. Zero-days won't wait for you to get certified.”

“The agency to act swiftly determines who will be outplayed in the game of AI-led exploit/defense.”

“AI has shrunk the vuln-to-exploit window. Defenders don't have luxury of time, patching to be at machine speed”

“Traditional VM was built around the assumption that you have time to prioritize. You don't anymore.”

“The clock ticks away, Old souls fade as threats evolve, AI: our last hope.”

“The exploit window is collapsing. Security must move upstream into the software lifecycle.”

“AI makes hackers faster than ever. Security teams must shift from calendar time to compute time.”

“Zero Trust principles must be applied far beyond 'networking' - to all layers of the stack down to hardware.”

“In a less catastrophic sense, it reminds me of Don't Look Up.”

“The diff tells the truth. They read your merge before you. Write less - mean it all.”

“The window from disclosure to exploitation has collapsed. In the AI era, protection must happen at runtime”

“The exploit window is gone. Incentivize zero-fail engineering and structurally defend at machine speed.”

“Prevention is better than cure. AI run security test pass before every code/patch release must become normal.”

“I've long said the one with the better, faster algorithms wins. We built Wirespeed because we saw this coming.”

“We build fuzzers and find bugs. The gap between disclosure and weaponization was our window. Now it's gone.”

“The world runs on software, It's the backbone of communication, finance, and healthcare. Security matters!”

“The luxury of analysis and prioritization is quickly moving behind us. The exciting era of agentic VM is here.”

“Securing tomorrow requires action today.”

“Every second of delay only benefits the threat actor. Is your IR machine-speed ready?”

“As patch windows collapse, we need resilience beyond prevention — to anticipate, withstand, recover and adapt.”

“AI eliminates something defenders have always relied on: time. Cyber risk is now a velocity problem.”

“AI is going nuts...”

“The attacker's advantage grows daily. The only counter: prevention tools that work where critical code lives.”

“Reactive security is obsolete. In an AI-driven threat landscape, only secure-by-design can keep pace”

“Security has historically relied on the idea that there will be time to react which is no longer a privilege.”

“TTE will only drop with AI and response SLAs are already getting overwhelmed.”

“7 months ago, we proved CVE exploitation with AI is near-instant. TTE has been in a nosedive ever since.”

“This isn’t a race against threat attackers. It’s a debt crisis and the interest just went compound with genAI.”

“These trend lines make one thing clear, traditional defenses are insufficient. We eliminate classes of vulns.”

“Boards must shift from ‘Are we compliant?’ to ‘Are we fast enough?’ Patch speed is the key to resilience.”

“Exploitation is entry, not outcome. Defenders own the graph--aim untiring compute at every attack path after.”

“Most organizations underestimate the democratization of vulnerability discovery & exploitation. That complacency is more dangerous than ever.”

“Social engineering used to require skill. Now it requires a prompt.”

“Speed is the new paradigm. Focus was the old mantra. Now we need both.”

“The Zero Day Clock makes one thing clear: security now demands anti-fragility, not just resilience.”

“The World is changing fast and we have to adopt accordingly.”

“Technologies show options but it's action that makes us better. (The quote can be used by both the good and the bad.)”

“As the paradigm shifts to AI-speed attacks, our defensive capabilities must overcome human latency and make the exact same leap.”

“the world has historically benefited from the fact that vulnerability searching is a semi-rare skill and there's not huge demand for it. The models significantly alter the scarcity of that skillset in a way that favors offense and requires new tools.”

“Cybersecurity is still treated as a task for a small group of specialists. If we want to live safely, everyone must contribute and help close the alarming skills gap.”

“Threat actors used to have two limitations: skill and being human. Both of these collapsed overnight. Every previous technology shift that disrupted the world gave us TIME to adapt. We don't have this luxury now.”

“The Observe, Orient, Decide, Act (OODA) Loop just got more challenging. This is an arms race. It's not just about speed it's about creating or preventing disruption.”

“We spent decades making attacks expensive. AI just made them cheap. That is not a security problem anymore. It is an economics problem, and the math does not favour defenders.”

“As time‑to‑exploit approaches zero, the cost of insecurity returns to where it belongs: operations, downtime, and business survival.”

“AI is fueling the rise of IT security threats. The Zero Day Clock illustrates this clearly and helps raise awareness of the issue.”

“The age of AI superpowers shouldn’t belong only to the bad guys - let’s empower our blue teams and co‑author the post‑Mythos agenda.”

“The Zero Day Clock proves we can no longer wait for a CVE to act. Real-time visibility into PreCVEs is essential for software supply chain security, allowing us to identify risks and harden architectures before a vulnerability is even named.”

“AI is accelerating the discovery of vulnerabilities and reducing the time required for hacking. Only a very good structure and a well-established process can help reduce the attack surface.”

“The zero day clock provides a compelling reason to act . Agentic based defence is the only way to detect and respond against AI cyberattacks 2026 and beyond.”

“We know our adversaries. Now we need to know ourselves better, and respond faster than ever before.”

““At machine speed, you can’t outpace the attacker. You can only remove the attack surface and deceive what remains. You can’t attack what you can’t see.””

“The entire security model needs to evolve with the pace at which vulnerability can be exploited. We need to move from doing point-in-time security testing like pentests are done today to always-on security testing.”

“Let's embrace obsolescence management. Patching and reactive models are outdated. Traditional SOCs can't scale to instant exploitation. AI makes attacks cheaper and defenses more expensive. Let's be strategic, collaborative, resilient, & coordinated.”

“These are unprecedented times. CISOs need to rebuild the SOC from scratch before it is too late. Human analysts are too slow. A CISO supported by a staff consisting mostly of machine-speed intelligent agents is the future of security.”

“If you maintain edge security appliances like firewalls, ZeroDayClock shows that the very devices you trust to protect your network may now be your greatest risk.”

“Human speed will no longer be sufficient, we need to adapt to machine speed NOW to restore the symmetry again between attacker and defender speed.”

“In a zero-day world, detection is already late, the only winning move is to design systems that assume compromise from the start.”

“No doubt we are entering a world where AI can attack and defend —faster than any human. The question now is who who powers, owns & controls it.”

“The real clock isn't measuring time-to-exploit. It's measuring time-to-intent”

“If you have operationalized an assume-breach defense, nothing much changes. More attacks give you opportunities to get stronger, faster. Think of this like an immune system. Learn from the attacks. But, if you haven’t been assuming breach, good luck.”

“The Zero Day Clock shows that time is no longer on the defender’s side. For organisations that underpin society, like postal and logistics services, this means designing systems that can withstand compromise — not just react to it.”

“Attackers’ openness is winning over defenders siloed paradigms. The uneven battlefield proves that defenders cannot pick up the pace without a significant paradigm shift. One may argue that defenders are somewhat enriching attackers paradoxically.”

“My patch SLA says 30 days. My adversary's runtime says 30 seconds. The auditor asks which one we documented. The Zero Day Clock asks which one mattered.”