What protects your business when a critical patch has to wait until Sunday, but an attacker can try the weakness today?
In an open letter, OpenAI called on businesses, governments, security providers, and AI companies to coordinate cyber defense as AI makes it easier to find and exploit weaknesses. The letter urges organizations to fix the most dangerous gaps quickly, verify that the fixes work, and put safeguards in place when patching would interrupt essential services. Read OpenAI’s collective cyber defense letter.
Key takeaway. AI can help defenders find and fix weaknesses faster, and businesses still need protection while those fixes are pending. Windows Isolation and Containment can block specific actions an attacker needs, even when security tools have yet to identify the attack.
What is OpenAI asking organizations to do?
OpenAI is asking leaders to treat serious cyber exposure with the urgency of an incident. It also wants AI companies, security providers, and governments to share tested fixes and put more tools, training, and hands-on help in the hands of defenders, particularly those running essential services.
OpenAI’s own Defense Factory illustrates the idea. The company describes using AI to find and validate weaknesses, route them to the people who can fix them, and independently verify fixes after deployment. A smaller organization can apply the same principle with a short list of critical exposures, an owner for each, and evidence that each fix reached the systems at risk. See OpenAI’s Defense Factory case study.
Why does the time between discovery and patching matter?
A weakness can be exploited while your team is testing an update, waiting for vendor approval, or scheduling downtime. Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation was the initial access method in 31% of breaches in its reporting dataset. In its analysis of known exploited vulnerabilities, the median time to fully patch was 43 days, up from 32 days in the previous report. Read the Verizon 2026 Data Breach Investigations Report.
Consider a manufacturer that can take its scheduling system offline only between shifts. An emergency update could interrupt production. Leaving that system broadly accessible until the next maintenance window gives an attacker more time to reach it and potentially disrupt shipping or order processing. Restricting who can reach the system and verifying that the restriction works can reduce exposure while the team prepares the patch.
Where does Detect and Respond fit?
Endpoint detection and response (EDR) helps teams spot suspicious activity, investigate what happened, and disrupt an attack. Some EDR tools can block activity automatically, and a separate prevention policy can still help when an alert comes late or an attacker abuses an approved tool.
For example, an office application may be allowed to open invoices and still have no business launching a scripting tool. A policy can block that action as it happens, while EDR helps the team trace the attempted activity and check whether other devices were affected.
What if you did not have to detect the attack in order to stop it?
A Windows endpoint can deny an action because it falls outside an application’s assigned permissions. That means a new exploit or AI-generated script can fail at a step it needs, even if defenders have never seen that exact version.
Isolation and Containment give applications boundaries. Launch controls can stop unauthorized programs or scripts from running. Policies can restrict trusted applications from starting other processes, reaching protected files, or accessing another process’s memory. That reduces the usable Windows attack surface and can prevent file encryption where policy denies write access to the targeted files.
AppGuard is one example of this approach. It has more than a decade of release history and applies Windows endpoint restrictions without requiring the activity to first be classified as malicious. The protection depends on which applications and actions the policy covers. Read about AppGuard’s approach and release history.
What Should Businesses Do Next?
Start with one system your business cannot afford to lose for a day. Ask IT or your MSP to show you what protects it today and what would happen if a patch had to wait.
- Prioritize exposed systems and known exploited flaws. Assign an owner and a deadline. Verify that the fix reached every affected system.
- Make patch exceptions temporary. Record the reason, restrict access or disable the vulnerable feature where feasible, test the safeguard, and give the exception a review date.
- Test Windows application boundaries. In a pilot, confirm that users can do their jobs and that approved applications cannot start unauthorized scripts or modify protected files.
- Keep response and recovery ready. Exercise your EDR response, test a backup restore, and track the time it takes to verify a fix or put a temporary safeguard in place.
What should leaders ask at the next security review?
Ask your IT team or MSP, “What would stop an attacker from turning an unpatched weakness into a business outage this week?” Ask them to show which actions are blocked and how they tested those controls. Faster patching shortens the time you are exposed. Tested guardrails reduce what an attacker can do during that time.
For a practical next step, review examples of Windows application and file restrictions with your IT team or MSP. Explore Windows endpoint prevention examples.
November 12, 2026