This chapter adds to confidentiality, integrity and availability a property that the earlier chapters of Part II assumed without naming: time. How fast the estate can notice that something is wrong, decide and act is a property of the design that the architect owns, as the architect owns a boundary. The chapter concerns Shift 3, from periodic to continuous, at machine speed, because patch velocity, detection, containment and the stop path are measured continuously rather than reviewed once a year. It concerns Shift 2, from gatekeeper to boundary designer equally, because decisions that must be taken in minutes are delegated in advance under conditions the architecture enforces.
The chapter builds on the earlier volumes. Architecture as Code (Chapter 9B) held that manual incident response cannot scale when attacks develop within minutes and that compromised components are redeployed from known-good definitions (161, Nordqvist, 2025). AI Governance, Chapters 13 and 24, held that stop and patch decisions are named and delegated before they are needed (162, Nordqvist, 2026). AI Platform and Security, Chapter 18, committed to patch velocity as a service level and to detection with the authority to act (163, Nordqvist, 2026), and AI Threat, Chapter 30, held that the right to stop must be cheaper to exercise than the right to continue (165, Nordqvist, 2026). Two questions were left open: what machine-speed adversaries and insiders mean for how architecture is designed, reviewed and changed, and whether patch velocity will become a supervised metric.
Mandiant measured the average time from disclosure to exploitation at 63 days in 2018 and 2019 and at five days in 2023 (139, Charrier & Weiner, 2024), and M-Trends 2026 estimated the mean time to exploit at minus seven days, so exploitation now often begins before a fix exists (138, Mandiant, 2026). The Google Threat Intelligence Group reported in September 2026 that in-the-wild exploitation rose from an average of 10.5 vulnerabilities a month in 2025 to 18 a month in 2026, driven by rapid weaponisation of new disclosures, while only 0.23 per cent of disclosures were exploited; it called the trend an early indicator (141, Grunewald et al., 2026).
Primary topics explored
- The collapsing window
- Four intervals the architect owns
- Patch velocity as a service level
- Designing for patchability
- Decisions delegated in advance
- Detection designed in
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 10: Architecting at Machine Speed: Patch Velocity, Detection and the Stop Path by Design in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Craft” and is one of 31 drawn from the manuscript.