Skip to content
kevinferron.com

T2 · Security in the age of AI · Interactive, in your browser

The shrinking exploit window

How long passes between a flaw being disclosed and being used, and what the measurements do and do not say.

Time to exploit is reported to be falling, but each study counts it differently.

Time to exploit, as Mandiant measured it

Average, in days

Days from a patch to the first exploitation, averaged over the vulnerabilities Mandiant tracked as exploited in the wild.

63ae
44ae
32abc
5abd
−7f
  • Mandiant’s average, as wide as its period
  • The same average without the cap or with the outliers
  • An estimate, method not stated

Select a bar to see what it counts and what Mandiant says about it.

Each bar is an average, in days, for the period Mandiant named: the bar is as wide as the period, so the widths are uneven. The small diamonds are the same average the way Mandiant gives it without the cap or with the outliers. Read the fall as a direction, not as a clean line.

All footnotes
  • aMandiant says its figures are conservative: it uses the first reported date of exploitation and, where a source gives only a vague timeframe, the latest date that fits. The real times are almost certainly earlier.
  • bThe definitions differ between the two posts. The 2021 to 2022 post calls a vulnerability a zero-day if it was disclosed before a patch was available; the 2023 post counts one exploited before a patch was available and leaves out end-of-life technologies. This is my reading of the two posts, not a caveat Mandiant states, so the periods are not strictly comparable.
  • cThe 2021 to 2022 average includes seven unpatched vulnerabilities whose time was capped at the end of their year. Without the cap it would be lower.
  • dThe 2023 average leaves out 15 outliers (two n-days and 13 zero-days) found with a standard-deviation test. With them included, the average is much longer.
  • eThe two earliest values are shown as Mandiant restates them in its later posts; this page did not read how those periods were counted.
  • fThe estimate is not joined to the series: a negative value means exploitation routinely came before a patch, but no population, period or method is stated for it, so it may not be the same measure as the bars.

Exploited on or before the day the CVE was published

VulnCheck, vendor dataA different measure
  • 202327%

    VulnCheck (vendor data): the share of the vulnerabilities on its own list first seen exploited in 2023, as restated in its 2024 post. VulnCheck, 2024 trends.

  • 202423.6%

    VulnCheck (vendor data): of 768 CVEs first publicly reported as exploited in 2024. VulnCheck’s 1H 2025 post notes that later evidence has pushed this figure up over time. VulnCheck, 2024 trends.

  • First half of 202532.1%

    VulnCheck (vendor data): of 432 CVEs first reported exploited in the first half of 2025, a half-year; VulnCheck says sources it added raised the volume and speed. VulnCheck, 1H 2025.

  • 202528.96%

    VulnCheck (vendor data): of 884 vulnerabilities first seen exploited in 2025. VulnCheck, State of Exploitation 2026.

The scale runs from none to all of the vulnerabilities VulnCheck first saw exploited in the period.

A different measure from the bars: a share, not days; VulnCheck’s own list, which is broader than CISA’s; and the day the CVE was published as the reference, not the day of the patch. Same-day exploitation is not always a zero-day. VulnCheck says its 2025 pattern was highly consistent with 2024.

Mandiant’s average time to exploit is the days from a patch to the first exploitation of a vulnerability it tracked as exploited in the wild. It fell from 63 days in 2018 and 2019 to 44 days in 2020 to the start of 2021, 32 days in 2021 and 2022, and 5 days in 2023. Two of those carry caveats Mandiant gives itself. The 2021 to 2022 average includes seven unpatched vulnerabilities whose time was capped at the end of their year, and without the cap it is 20 days. The 2023 average leaves out 15 outliers, and with them it is 47 days. Mandiant calls its method conservative, so the real times are almost certainly earlier. The definitions also differ between the two posts, which is my reading rather than a caveat Mandiant gives, so the periods are not strictly comparable.

Two other figures sit apart from that series. M-Trends 2026 gives the mean time to exploit as an estimated −7 days, which would mean exploitation routinely comes before a patch, but the post states no population, period or method, so the page draws it separately and does not join it to the bars. VulnCheck (vendor data) measures something else: the share of the vulnerabilities on its own list, first seen exploited in a period, whose exploitation evidence is dated on or before the day the CVE was published. It reports 27% for 2023, 23.6% for 2024, 32.1% for the first half of 2025 and 28.96% for 2025, and says the 2025 pattern was highly consistent with 2024. That is a share, not days, set against the publication day, not the patch, so it cannot go on Mandiant’s axis.

Volume has grown, but volume is not exploitation. The CVE Program published 40,077 records in 2024 and 48,244 in 2025, and 35,872 in the first half of 2026 alone; the second half is not yet published. CISA added 245 entries to its Known Exploited Vulnerabilities catalogue in 2025 and 272 in 2026 up to 23 October (catalogue version 2026.10.23), and the first two years, 311 in 2021 and 555 in 2022, are mostly a backlog loaded at launch. Google’s threat intelligence group warns that automated CVE policies inflate the count: about 5,000 records between January and August 2026 mention the Linux kernel, with no zero-days exploited in the wild. The share of catalogue entries flagged as used by ransomware falls from 27.0% of 2021’s additions to 9.9% of 2026’s, but the flag is updated after the fact, and VulnCheck (vendor data) expects 2025’s attribution to keep rising, so recent years may lag.

CISA’s BOD 26-04, issued on 10 June 2026 to replace BOD 22-01, sets how long federal civilian agencies have to fix a flaw, from four questions: whether the asset is publicly exposed, whether the flaw is in the Known Exploited Vulnerabilities catalogue, whether an adversary can automate exploiting it, and whether it gives partial or total control. The answers include 3, 14 or 60 days, or a fix on the next system upgrade, and an exposed flaw in the catalogue that gives total control gets 3 days plus forensic triage. Against that, Verizon’s median time to fully remediate catalogue vulnerabilities was 38 days in its 2025 report and 43 days in the 2026 summary. The summary compares its figure with “the previous year’s 32 days”, but in the 2025 report 32 days was the median for a subset of edge devices and the whole catalogue’s was 38, so I compare with 38. A deadline for agencies and a median across many organisations are not like for like, so the gap is a pointer, not a measurement. The directive’s own prediction about where this is heading is in the next paragraph.

Two predictions and two findings, kept apart. The UK’s NCSC predicted in May 2025 that AI will “almost certainly” shorten the time between disclosure and exploitation further, which it says has already shrunk to days. CISA’s BOD 26-04 predicts that attackers’ use of AI “may further narrow” the time defenders have between a patch and exploitation. Google’s threat intelligence group, in September 2026, counted vulnerabilities disclosed from January 2025 to August 2026: the exploited ones averaged 10.5 a month in 2025 and 18 a month from January to August 2026. Because zero-days rose only a little, GTIG says the figures “suggest” most of the growth is n-day exploitation, flaws exploited after a patch is out, and it calls it possible that actors use language models to analyse patches; it also says that since May 2026 exploitation has grown in step with disclosure rather than faster. In May 2026 GTIG reported the first zero-day it believes was built with AI, with “high confidence” that the actor used an AI model; it was disrupted before use, and GTIG does not believe its own Gemini was involved.

My viewMy view: that the window is shrinking is a direction, not a number. Mandiant’s own caveats move its 2023 figure from 5 days to 47 days when the outliers go back in, and nothing I read gives one measure of the time from disclosure to exploitation that holds across years. What I am surer of is the mismatch in clocks. Attackers work in days, and by the measurements in chapter 1 in minutes once inside, while the median organisation takes weeks to fully fix what is already known to be exploited. That is a reason to want machines doing the first pass, which is this series’ argument. It is not evidence that AI caused the shortening: GTIG itself says exploitation has tracked disclosure.

Exercise

Try it on the numbers.

  1. Select the 2023 bar and read what changes when the outliers are put back.
  2. On the volume view, switch between the two counts and find which years are only part of a year.
  3. On the deadlines view, answer for a laptop that is reachable from the internet and has a flaw in the catalogue that gives total control, then compare its deadline with Verizon’s medians.

Sources

  1. Mandiant, time-to-exploit 2023 How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends. 15 Oct 2024; 138 vulnerabilities disclosed in 2023 and exploited in the wild; read 2026-10-24.

    Read in full. An average of Mandiant’s tracked cases; the definitions differ between the 2021 to 2022 and 2023 posts (my reading, not a caveat Mandiant gives), and the 2023 average leaves out 15 outliers.

    • Paragraphs 2 to 4: the conservative method, the averages by period, the 15 outliers and the average with them
    • Paragraph 2: the conservative method
    • Paragraph 4: 15 outliers excluded; the average with them
    • Paragraph 3: the average by period, as restated
    • Paragraph 3: average time to exploit by period, 2018 to 2019
    • Paragraph 3: average time to exploit by period, 2020 to the start of 2021
    • Paragraphs 1, 3 and 4: the 2023 population, the average of 5 days and the 47 days with the outliers

  2. Mandiant, time-to-exploit 2021 to 2022 Analysis of Time-to-Exploit Trends: 2021-2022. 28 Sep 2023; 246 vulnerabilities disclosed in 2021 and 2022 and exploited in the wild; read 2026-10-24.

    Read in full. An average of Mandiant’s tracked cases. The 2021 to 2022 average includes seven unpatched vulnerabilities whose time was capped at the end of their year.

    • The time-to-exploit paragraph: the cap on seven unpatched vulnerabilities and the average without it
    • Paragraph 1: the 2021 to 2022 zero-day and n-day definitions (the 2023 post’s are in its own paragraph 1)
    • The time-to-exploit paragraph: seven unpatched vulnerabilities capped, and the average without the cap
    • Key points and the time-to-exploit paragraph: the 2021 to 2022 average, its cap and the average without it

  3. Google Cloud, M-Trends 2026 M-Trends 2026: Data, Insights, and Strategies From the Frontlines. 23 Mar 2026; Mandiant investigations of 2025; read 2026-10-24.

    The blog post, not the full report. Mandiant’s cases are incident-response engagements, not a random sample of organisations.

    • The section on espionage and edge devices: the mean time to exploit dropped to an estimated −7 days

  4. VulnCheck, 2024 trends 2024 Trends in Vulnerability Exploitation. 3 Feb 2025; read 2026-10-24.

    The blog, read in full. Counts the vulnerabilities on VulnCheck’s own list of known exploited vulnerabilities, which is broader than CISA’s, against the day the CVE was published. The 2023 figure is restated in this post.

    • The timeline paragraph and key points: the 2023 and 2024 shares
    • The timeline paragraph: the 2023 share exploited on or before the day the CVE was published
    • Key points: 768 CVEs and 23.6 percent on or before disclosure day

  5. VulnCheck, 1H 2025 State of Exploitation - A look Into The 1H-2025 Vulnerability Exploitation & Threat Activity. 30 Jul 2025; first half of 2025; read 2026-10-24.

    The blog, read in full. A half-year; VulnCheck lists caveats about sources it added in the period, which raised volume and speed.

    • Key takeaways: the first-half 2025 share and its caveats
    • The caveats: later evidence has pushed the 2024 figure up over time
    • Key takeaways and “How Quickly…”: 432 CVEs and 32.1 percent, with the caveats on added sources

  6. VulnCheck, State of Exploitation 2026 VulnCheck State of Exploitation 2026. PDF created 9 Feb 2026; covers calendar 2025; read 2026-10-24.

    The PDF, read in full (12 pages). VulnCheck’s own list and its own definitions; the labels of its timeline chart were paired with values from the text layer.

    • Pages 2 to 4 and 10: the 2025 share, and a pattern consistent with 2024
    • Page 2 key takeaways and page 9: ransomware attribution lags initial exploitation disclosure
    • Pages 2 to 4: 884 KEVs and 28.96 percent on or before the CVE publication day

  7. CVE Program, metrics CVE Program Metrics: Published CVE Records. snapshot as read 2026-10-24; the third and fourth quarters of 2026 show “TBA”.

    The table of published CVE Records per calendar quarter. Quarters of the current year are recalculated (for example to remove rejected records); earlier years are not.

    • The “Published CVE Records” table: yearly totals and the first two quarters of 2026
    • The “Published CVE Records” table: the total for each calendar year; 2026 is the first and second quarters only

  8. CISA, KEV catalogue Known Exploited Vulnerabilities Catalog (JSON feed). catalogVersion 2026.10.23, released 23 Oct 2026; 1,756 entries; read 2026-10-24.

    The counts by year added and the ransomware flag were computed from this feed. The flag is a current-state field and the feed keeps no history of when it changed.

    • Computed from catalogVersion 2026.10.23: additions by year and the ransomware flag; 287 of 2021’s entries on the first day
    • Counts by year of dateAdded and the ransomware flag, computed from catalogVersion 2026.10.23
    • Computed from the catalogue: 287 of the 311 entries for 2021 were added on 2021-11-03, the catalogue’s launch day

  9. Google GTIG, September 2026 Vulnerability Discovery and Exploitation Trends in the AI Era. 30 Sep 2026; vulnerabilities disclosed 1 Jan 2025 to 31 Aug 2026; read 2026-10-24.

    The key findings, the exploitation section and the section on CVE inflation. The monthly series is in charts that were not read as data.

    • “Distinguishing Threat Risk from CVE Inflation”: automated CNA policies and about 5,000 Linux kernel CVEs
    • Key findings, the n-day section and the indexed-growth section: 10.5 a month to 18 a month, “suggest”, and exploitation tracking disclosure

  10. CISA, BOD 26-04 BOD 26-04, Prioritizing Security Updates Based on Risk. 10 Jun 2026 (it replaced BOD 22-01); read 2026-10-24.

    The background section and Appendix A, Table 1 (an image, read visually). A directive for federal civilian agencies.

    • Background and Appendix A, Table 1: the four inputs and the timelines, in calendar days
    • Background, paragraph 2: AI may further narrow the time between patch release and exploitation

  11. Verizon, 2025 DBIR 2025 Data Breach Investigations Report. PDF created 21 Apr 2025; incidents collected from 1 Nov 2023; read 2026-10-24.

    The full report. Remediation medians come from vulnerability-management data contributed by about 10,000 companies.

    • Pages 29 to 31, Table 1 and Figures 29 and 30: median time to full remediation, 32 days for the edge subset and 38 for the whole catalogue
    • Pages 29 to 31, Table 1 and Figures 29 and 30: the median time to full remediation for all KEV vulnerabilities

  12. Verizon, 2026 DBIR summary 2026 Data Breach Investigations Report, Executive Summary. 2026; dataset Oct 2024 to Nov 2025; read 2026-10-24.

    The executive summary only; the full 2026 report was not read.

    • Page 9: median time to full resolution 43 days, compared with “the previous year’s 32 days”
    • Page 9: median time to full resolution 43 days; only 26 percent of KEV vulnerabilities fully remediated in 2025

  13. UK NCSC, 2025 Impact of AI on cyber threat from now to 2027. 7 May 2025; read 2026-10-24.

    An assessment in NCSC’s probability language; every judgement in it is a prediction. The probability yardstick’s percentage ranges are an image and were not read.

    • Assessment: the time between disclosure and exploitation has shrunk to days and AI will almost certainly reduce it further

  14. Google GTIG, May 2026 GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. 11 May 2026; read 2026-10-24.

    The opening sections and the vulnerability-discovery sections.

    • “Cyber Crime Threat Actors Discover and Weaponize Zero-Day Using AI”: a zero-day believed developed with AI, high confidence

Everything here is paraphrased from the sources, not quoted at length, and each claim is attributed to one. A prediction is kept as its source’s prediction, with its hedge. Vendor figures and a vendor-sponsored study are labelled as such. Where a source is silent or could not be read, the page leaves the fact out.