In the AI era, the pre-patch window needs its own security playbook