Hours, not weeks (McKinsey & Company)
McKinsey's Risk and Resilience team has a blunt line about enterprise cybersecurity: attackers now move at machine speed, and organisations decide at committee speed. Citing industry tracking data, the authors say the gap between disclosure of a critical vulnerability and active exploitation has fallen to hours, from roughly three weeks as recently as 2025.
Most security calendars were built for the three weeks. Monthly patch cycles, change advisory boards that often meet weekly, risk acceptance that waits for the next steering committee. McKinsey is explicit that none of this is dysfunction, because these processes protect uptime and compliance. The problem is that nobody owns decision speed. IT owns patching, the business owns downtime, legal owns disclosure, and no one function has the mandate to move the whole enterprise.
The part I would read first is the prescription on decision rights, which I have taken from a secondary summary of the article. It calls for a small cross-functional response cell with one decision-maker holding delegated authority to override normal change management for confirmed active threats, playbooks authorised in advance, and an executive liaison reporting to the board every 24 hours. One case has a critical vulnerability sitting unpatched for 11 days because no team could override a production change freeze.
My own extension: the question for a board is less "are we secure?", which invites reassurance, than "how long does it take us to act on a critical vulnerability, end to end, and who is allowed to decide?" The first answer is a number. The second is a name. Both belong in a document that was written before the incident.
A 2am decision to take a system offline is uncomfortable for everyone involved, which is exactly why it should be agreed in daylight, with the limits written down.
Source: McKinsey & Company, "The speed problem: How frontier AI exposes weakness in enterprise cybersecurity" https://lnkd.in/gZTVYXMW
#Cybersecurity #Boards #OperatingModel