Architecting at Machine Speed: Patch Velocity, Detection and the Stop Path by Design

All courses / The Transformed Security Architect / Module 2 / Chapter 10

Learning objectives

After the lesson the participant can:

• Explain the four intervals of the estate clock and why the decide interval usually holds most of the time.
• Define patch-velocity classes from public signals and exposure, each with a target and a decision path.
• State the conditions under which a patch or containment decision can be delegated in advance.
• Design a timed stop drill with a budget, instrumented intervals, named stop holders and a pass criterion.

Key concepts

Notice, decide, act, verify

The four intervals of the estate's clock: until someone who can act knows, until someone with the right has chosen, until the control is in effect, and until independent evidence shows the effect. A total alone hides where the time goes.

Patch velocity as a service level

The time from a vulnerability entering a priority class to a verified fix or compensating control, with a committed target per class and misses reported with reasons. Classes combine EPSS, KEV, the EUVD and exposure from the inventory.

Delegated in advance

For known-exploited vulnerabilities on exposed assets the decision is delegated beforehand and reviewed afterwards, under conditions that are properties of the architecture: a tested rollback, a health check, a canary ring and an exclusion list. The management body decides whether the delegation stands.

Canary

An object no legitimate process has a reason to touch, such as a decoy credential, host entry or tool, so a touch is a high-confidence alert that needs no baseline. Its registry sits outside the reach of what it watches.

Timed stop path

A stop path that lives outside the system it stops, has more than one mechanism sharing no dependency, is held by named people around the clock, and is measured by drill against a budget set from blast radius.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. In most estates the time goes in the decide interval. Where does a known-exploited vulnerability on an exposed asset wait in your organisation, and who would have to approve removing that wait?
2. The chapter argues that an estate able to act in minutes loses little if the window stops shrinking. How persuasive is that argument for a board weighing the cost?
3. Nordvik cannot build machine-speed properties itself. What should a contract annex for a managed security service provider specify so that the numbers are observable and not declared?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. In the chapter's default classes, what is the target for a known-exploited vulnerability on an internet-facing asset?

   1. 7 days, as an expedited standard change
   2. 30 days, as a standard change
   3. 24 hours mitigation and 72 hours fix, delegated in advance
   4. 4 hours fix, approved by the change advisory board
   Show the answer

   C. 24 hours mitigation and 72 hours fix, delegated in advance
   The exploited and exposed class, signalled by KEV or EUVD exploited status on an internet-facing asset, carries 24 hours for mitigation and 72 hours for the fix, with the decision delegated in advance.

2. Why did Hansa's first timed stop drill of the IT-operations agent fail its five-minute budget?

   1. The alert reached a duty analyst without the decision, and 15-minute tokens outlived the revocation
   2. The canary registry was readable by the agent, which avoided the decoy
   3. The managed security service provider held the runbook but lacked credentials to the integration gateway
   4. The executive board had not yet approved the delegated playbook
   Show the answer

   A. The alert reached a duty analyst without the decision, and 15-minute tokens outlived the revocation
   The drill took 17 minutes: the alert went to a SOC duty analyst who had to page the operator and had no mandate to apply the deny rule, and credential revocation alone left 15-minute tokens valid.

3. How does the chapter label the claim that patch velocity will become a supervised metric?

   1. Observable, because NIS 2 Article 21(2)(e) on vulnerability handling already requires a reported service level
   2. Expected, on the signal of the European Central Bank's July 2026 letter to significant institutions
   3. Speculation, as AI Platform and Security, Chapter 25, labelled it
   4. Observable, because CISA's directive applies to European entities
   Show the answer

   B. Expected, on the signal of the European Central Bank's July 2026 letter to significant institutions
   The chapter labels it expected, on a stated signal: in July 2026 the European Central Bank wrote to significant institutions about AI-enabled cyber threats, placed the response with management bodies and asked for action plans.