Zero-Days on a Clock Measured in Minutes: When Discovery Outruns Review

The Discovery That Outran the Reviewer

A vulnerability researcher, in the traditional model, is a patient craftsperson. Finding a zero-day — a previously unknown flaw in software that the vendor has not yet patched — required weeks or months of manual analysis: reading source code or disassembling binaries, understanding the logic of the target, hypothesizing where an input might be mishandled, constructing a proof of concept, and validating that the bug is exploitable. The product of this work was a single vulnerability, accompanied by a written report that a human at the vendor could read, understand, and use to develop a fix.

That model assumed a particular relationship between the speed of discovery and the speed of review. Discovery was slow, review was slow, and the two were roughly balanced. A researcher would find a bug, write it up, submit it, and a vendor engineer would triage, reproduce, and patch it within a disclosure window measured in weeks or months. The system was not perfect, but it was coherent. The humans on both sides could keep up with each other.

In 2027, that coherence is gone. Autonomous discovery models — systems that combine code analysis, fuzzing, and reasoning to identify and validate previously unknown vulnerabilities — are finding zero-days at a pace that no human review process can match. A single model run can surface dozens of candidate vulnerabilities in a codebase in hours. A sustained campaign can produce hundreds. The clock is no longer measured in the weeks of a researcher's attention. It is measured in the minutes of a model's compute.

This is not a marginal acceleration. It is a phase change. And it breaks the two institutions that have governed vulnerability handling for the last two decades: responsible disclosure, and the vulnerability market.

The New Discovery Pipeline

To understand why the old institutions break, it is necessary to understand what the new pipeline looks like.

The autonomous discovery systems of 2027 are not single tools. They are pipelines that integrate several capabilities. Static and dynamic analysis identifies candidate code paths where inputs are handled. Fuzzing at scale generates inputs designed to trigger those paths. Reasoning models examine the candidates, distinguishing true vulnerabilities from false positives, and in many cases constructing working proofs of concept that demonstrate exploitability. The output is not a list of suspicious locations but a set of validated, exploitable vulnerabilities, each with a reproduction and an impact assessment.

The key properties of this pipeline are speed, volume, and autonomy. Speed: a pipeline that once took a researcher a month now completes in an afternoon. Volume: a pipeline that once produced one vulnerability now produces dozens per run. Autonomy: the pipeline does not require a skilled researcher to operate it. It requires an operator who can define the target and interpret the output, but the expertise is in the system, not the human.

The implication is that the rate of zero-day discovery is no longer bounded by the supply of skilled researchers. It is bounded by compute. And compute is elastic. An operator who wants more vulnerabilities runs more compute. The discovery rate scales with budget, not with human capital.

The Collapse of the Disclosure Window

Responsible disclosure is the practice of reporting a vulnerability to the vendor privately, giving the vendor time to develop and release a patch, and only then publishing the details. The norm emerged because it balanced two goods: the public's interest in knowing about vulnerabilities that affect them, and the public's interest in those vulnerabilities being fixed before attackers exploit them. The disclosure window — the time between private report and public publication — was the mechanism that reconciled these goods. It gave the vendor enough time to patch, and it gave the public enough assurance that the vulnerability would not be hidden indefinitely.

The norm assumed that the disclosure window could be set by human judgment. A researcher would report a bug, a vendor would say "we need ninety days," and the researcher would agree or negotiate. The window was a matter of agreement between two humans who could each assess the complexity of the work involved.

Autonomous discovery breaks this assumption in two ways.

First, the volume of vulnerabilities produced by a single pipeline run exceeds what any vendor can triage in the traditional window. A vendor that receives one vulnerability report can assign an engineer, reproduce the bug, and develop a patch in ninety days. A vendor that receives fifty reports from a single pipeline run cannot assign fifty engineers. The triage queue backs up. The patch development queue backs up. The ninety-day window, which was calibrated for the human-paced discovery rate, becomes impossible to meet at the machine-paced discovery rate.

Second, the speed of discovery means that the same vulnerability may be found independently by multiple operators in a compressed timeframe. If a model can find a zero-day in a popular library in an afternoon, then any operator running the same model against the same library will find the same zero-day in the same afternoon. The assumption that a privately disclosed vulnerability is known only to the reporter and the vendor — the assumption on which the disclosure window rests — no longer holds. The vulnerability may be known to several operators simultaneously, some of whom have no intention of disclosing it responsibly. The window is not protecting against a hypothetical future discovery. It is protecting against a present, simultaneous one.

The Triage Impossibility

The vendor's position in this environment is structurally untenable. The vendor cannot triage vulnerabilities at the rate they are being discovered. Triage — the process of reading a report, reproducing the bug, assessing its severity, and assigning it for patching — is a human activity. It requires judgment, context, and time. A vendor with a triage team of ten engineers can process perhaps a hundred reports a month at the depth required for confident patching. A single autonomous pipeline can generate that volume in a day.

The result is that vendors are forced to triage at a shallower depth — to prioritize based on automated severity scoring, to batch similar reports, to patch at the level of vulnerability classes rather than individual instances. This is not necessarily bad — some vulnerabilities are genuinely more important than others, and class-level patching can be more efficient. But it means that the responsible disclosure norm, which assumed that every reported vulnerability would receive individual human attention, is no longer describing what actually happens. Reports are being processed, but they are not being reviewed in the way the norm presupposed.

The Vulnerability Market Under Hyperinflation

The vulnerability market — the system by which vulnerabilities are priced and sold, whether to vendors through bug bounties, to brokers who resell to governments, or directly to offensive operators — is built on scarcity. A zero-day is valuable because it is rare. The price of a zero-day reflects the cost of finding it (high, because it required a skilled researcher's time) and the difficulty of finding another one (also high, because the supply of researchers and the rate of discovery were both limited).

Autonomous discovery is a supply shock to this market. The cost of finding a zero-day falls from months of skilled labor to hours of compute. The supply of zero-days rises from the rate at which researchers can find them to the rate at which operators can run compute. The economic consequence is straightforward: the price of zero-days falls, and it falls proportionally to the gap between the old cost of discovery and the new one.

This is hyperinflation in reverse — a hyperdeflation of the value of a zero-day. The implications cascade through every participant in the market.

Brokers who built business models on acquiring scarce zero-days and reselling them at a premium face a collapsing margin. Their value proposition was access to a scarce resource. The resource is no longer scarce. They must either move up the value chain — offering integration, targeting, and operational support rather than raw vulnerabilities — or accept that their inventory is commoditizing.

Vendors who run bug bounty programs face a budget crisis. A bounty priced for the old scarcity — tens or hundreds of thousands of dollars for a high-severity zero-day — is now dramatically above the cost of discovery. The bounty program will be flooded with submissions, many of them valid, at a cost the vendor cannot sustain. But lowering the bounty risks driving researchers (and the models they operate) to the broker market, where the vulnerability is sold to an offensive operator rather than disclosed to the vendor. The vendor is caught between a bounty that is too high to pay at the new volume and too low to divert discovery from the offensive market.

Offensive operators — nation-state intelligence services, criminal groups, and the new class of autonomous-capable actors — face a bonanza. The cost of acquiring a zero-day has fallen to the cost of running a model. Operations that were previously constrained by the scarcity and expense of zero-days are now constrained only by compute budget. The strategic implication is that zero-day exploitation, once a carefully hoarded capability reserved for high-value targets, is becoming a routine tool. The hoarding calculus inverts: a zero-day that cost a million dollars to acquire was worth hoarding for the right target. A zero-day that costs a model run to acquire is worth using on any target where it works.

The End of the Zero-Day Reserve

The most consequential effect of the supply shock is the end of the zero-day reserve. Nation-state operators have historically maintained reserves of zero-days — vulnerabilities they have discovered or acquired but not used, held in reserve for future operations. The reserve existed because zero-days were scarce and expensive, and because using one risked burning it (a used zero-day may be detected and patched, ending its usefulness). The rational strategy was to hold zero-days for the operations that justified their cost.

When zero-days are cheap and quickly replaceable, the reserve loses its rationale. There is no reason to hold a zero-day in reserve when another can be found in an afternoon. The operator's strategy shifts from conservation to expenditure. More zero-days are used, against more targets, more frequently. The defensive consequence is that the rate of zero-day exploitation in the wild — the rate at which defenders encounter attacks using previously unknown vulnerabilities — rises sharply. The defender's environment becomes denser with zero-day attacks, not because any single attack is more sophisticated but because the economics that once constrained their use have collapsed.

What Responsible Disclosure Becomes

The responsible disclosure norm cannot survive the phase change unchanged. The question is what it becomes.

One trajectory is collapse. If vendors cannot triage at the discovery rate, and if the disclosure window no longer protects against simultaneous discovery, the norm loses its practical foundation. Researchers (and the operators of discovery models) may conclude that private disclosure is no longer worth the effort — that the vendor will not be able to act on the report in time, and that the vulnerability is already known to other operators. The norm reverts to full immediate disclosure, not out of malice but out of the recognition that the window no longer serves its purpose.

A second trajectory is adaptation. The norm could evolve to accommodate the new pace by shifting the burden of triage from the vendor to the system. Automated triage — models that reproduce reported vulnerabilities, assess severity, and prioritize patching — could process discovery at the rate it is produced. The disclosure window would shrink from ninety days to whatever time the vendor's automated patching pipeline requires, which may be days rather than months. The norm survives, but the humans are removed from the loop on both sides. Responsible disclosure becomes a transaction between two autonomous systems: the discovery model that reports, and the triage model that patches.

A third trajectory is structural. The norm could be replaced by a different institution altogether — one that does not depend on a disclosure window. The most promising candidate is a shift from vulnerability-by-vulnerability patching to structural defenses that do not require knowing the specific vulnerability in advance: memory-safe languages that eliminate entire classes of bugs, runtime mitigations that make exploitation impractical regardless of the underlying flaw, and architecture that assumes the presence of unknown vulnerabilities and contains their impact. In this trajectory, the discovery of a specific zero-day matters less, because the environment is designed to survive unknown vulnerabilities. The norm is not adapted; it is made obsolete by a change in the defensive paradigm.

The Review Bottleneck

The deepest problem is not the disclosure window or the market price. It is the review bottleneck. The entire vulnerability management system — disclosure, triage, patching, bounty pricing, market valuation — depends on a human being able to read a vulnerability report, understand it, and make a judgment about it. That human review is the rate-limiting step. It is the step that autonomous discovery has most decisively outpaced.

When discovery outruns review, the system does not stop. It degrades. Reports are processed more shallowly. Patches are developed with less analysis. Vulnerabilities are prioritized by automated scoring that may not capture the nuances a human reviewer would. The quality of the system — the confidence that vulnerabilities are correctly assessed and adequately patched — declines. The system continues to function, but at a lower fidelity.

This is the core challenge of the 2027 vulnerability landscape. It is not that zero-days are being found faster. It is that the human institutions that turned discoveries into fixes cannot keep up with the discoveries. The fix is not to slow discovery — that is neither possible nor desirable, since the same capability that finds offensive vulnerabilities finds defensive ones. The fix is to build review, triage, and patching infrastructure that operates at the speed of discovery. That infrastructure does not yet exist at the necessary scale, and building it is the urgent work of the next two years.

Conclusion

The zero-day is now on a clock measured in minutes. The discovery that once took a researcher a month takes a model an afternoon. The review that once took a vendor engineer a week must now happen in a day. The market that once priced a zero-day as a scarce resource is watching the scarcity evaporate.

The institutions that governed vulnerability handling — responsible disclosure, the disclosure window, the bug bounty, the broker market, the zero-day reserve — were all built for a world in which discovery was a human-paced craft. They are bending under the weight of machine-paced discovery, and some of them will break. The question for 2027 is not whether autonomous discovery will continue. It will. The question is whether the institutions that connect discovery to defense can be rebuilt at the speed the new discovery rate demands — or whether the gap between finding flaws and fixing them becomes the defining vulnerability of the era.

This dossier is part of the CyberArmory 2027 educational catalog. No live weapons are deployed. Every scenario is a controlled educational simulation designed to build pattern recognition and improve incident response readiness.