The Patch-Velocity Gap: AI Discovery Is Outpacing OSS Patching

Your SBOM Tells You What's Vulnerable. It Doesn't Tell You How Long It Will Stay That Way. Imagine your team runs a dependency scan before a release. Two hundred warnings. You triage by CVSS score — fix the criticals, document the highs, accept the mediums. You ship. Six weeks later, a medium-seve