Question 1

What is the Patch Gap?

Accepted Answer

The Patch Gap is the widening window between when a vulnerability is discovered, increasingly by AI, and when a production patch is actually deployed. Tuskira Research found this gap can stretch 90 to 150 days.

Question 2

How much faster is AI finding vulnerabilities than they are patched?

Accepted Answer

In Tuskira's analysis of Anthropic Mythos disclosure data, AI-driven discovery outpaced visible remediation by roughly 16.5x.

Question 3

How many vulnerabilities did the Tuskira Patch Gap research analyze?

Accepted Answer

The research analyzed 1,596 verified vulnerabilities across 281 open-source projects over a 63-day window.

Question 4

What share of disclosures had no public advisory?

Accepted Answer

About 95% of Mythos disclosures had no public advisory at the time of analysis, so most were not visible through CVEs, the NVD, GitHub advisories, or commercial scanners.

Question 5

What share of disclosed vulnerabilities had been patched?

Accepted Answer

Only 6.1% had been patched, despite 90.9% maintainer acknowledgment. Maintainers are responding, but patch capacity is not keeping pace with discovery volume.