The exploit window is shrinking. Most security workflows are not