Attackers may exploit vulnerabilities faster than organizations fully remediate them—but the available figures do not prove that vulnerability discovery outpaces repair across every organization. Verizon’s 2025 Data Breach Investigations Report estimated a five-day median from CVE publication to addition to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, while reporting median full-remediation times of 38 days across the KEV catalog and 32 days for its edge-vulnerability subset. Those figures illustrate a potentially dangerous response window, not a like-for-like measurement of discovery and repair rates.
What the vulnerability gap does—and does not—show
The “gap” is the period in which a vulnerability is known or being exploited but affected systems have not yet been fully remediated. A short interval between public disclosure and evidence of exploitation can leave defenders little time to identify affected assets, assess exposure, test a fix, and deploy it.
As an Amazon Associate I earn from qualifying purchases.
Verizon’s figures compare different events and populations. Its five-day figure is a median estimate for mass exploitation based on the time between CVE publication and the vulnerability’s addition to CISA’s KEV Catalog. Verizon describes it as an upper-bound estimate: KEV inclusion indicates the vulnerability was likely already causing harm. It is not a measurement of the exact time from disclosure to the first exploit.
The 38-day figure is Verizon’s reported median time for a company to fully remediate a vulnerability across the KEV catalog. The 32-day figure is the median for the report’s edge-vulnerability subset, not for all enterprise vulnerabilities. These are remediation durations, not measurements of repair capacity compared with the arrival rate of newly discovered flaws.
#1 Best Overall
| Verizon 2025 measure | What it measures | How to read it |
|---|---|---|
| 5 days | Median estimate from CVE publication to addition to CISA’s KEV Catalog, used as a measure of mass exploitation. | An upper-bound estimate for that interval; not the exact time to first exploitation. |
| 38 days | Median time for a company to fully remediate a vulnerability across the KEV catalog. | A remediation measure for that catalog-related population. |
| 32 days | Median full-remediation time for Verizon’s edge-vulnerability subset. | Applies to that subset, not to all enterprise vulnerabilities. |
Because the five-day and remediation figures have different endpoints and cohorts, they cannot be divided into a reliable discovery-versus-repair rate. They do show why organizations cannot assume that a patching process will finish before an actively exploited vulnerability creates risk. The figures do not establish that new vulnerabilities arrive faster than an organization can repair them across its entire portfolio.
Why a vulnerability finding does not become a fix immediately
Detection is only one part of organizational flaw management. CISA’s FY 2024 FISMA metrics guide identifies a broader set of processes: asset discovery, vulnerability scanning, analysis of results, patch testing, and patch management. Each step helps determine what is affected and how to address it safely; a scan result alone does not establish that the right fix has been deployed everywhere it is needed.
- Find the affected assets: Asset discovery and scanning help establish which systems may be exposed.
- Assess the findings: Teams analyze results and prioritize vulnerabilities in the context of affected assets and risk.
- Prepare the change: Patch testing can help determine whether an update is ready for deployment.
- Complete remediation: Patch management covers the work of applying and tracking the change.
The guide describes federal metrics and processes; it does not establish the staffing, tooling, or remediation speed of any particular private organization. It does, however, show why a vulnerability can be detected before the organization has completed the work needed to close it.
How to prioritize vulnerabilities that attackers are exploiting
CISA describes the KEV Catalog as a living list based on evidence of exploitation in the wild. It tells organizations to use the catalog as an input to their vulnerability-management prioritization framework. KEV status is therefore a signal to consider alongside the organization’s own exposure and affected assets—not a complete severity ranking, and not proof that every listed vulnerability affects every organization.
Rank #3
For vulnerabilities in the catalog, CISA’s incident and vulnerability response playbook directs defenders to remediate according to the catalog’s timelines. In most cases, the playbook says, remediation should consist of patching. For a specific CVE or due date, consult the current catalog entry because the catalog changes.
A practical prioritization decision should consider:
- whether there is evidence of active exploitation, including KEV status;
- whether the organization has exposed or affected assets, and how those assets are used;
- whether a vendor fix is available and ready to deploy;
- whether temporary mitigations can reduce exposure while patching is delayed; and
- whether a directive or regulatory deadline applies to the organization.
What to do when a patch cannot be applied promptly
A missing, untested, or not-yet-deployable patch does not make the exposure disappear. CISA’s playbook advises considering other measures to prevent exploitation when a patch does not exist, has not been tested, or cannot be applied promptly. It lists temporary risk-reduction options such as:
Recommended Free Tools
- disabling affected services;
- restricting access to the vulnerable system or application;
- isolating the system or application;
- making configuration changes;
- restricting traffic with firewall rules; and
- increasing monitoring.
These measures reduce exposure while a fix is unavailable or cannot yet be deployed; they are not interchangeable with a permanent fix. The organization still needs to track the vulnerability through to an appropriate remediation.
Best Value
Who must meet CISA’s KEV deadlines?
Binding deadlines under Binding Operational Directive 22-01 apply to U.S. Federal Civilian Executive Branch (FCEB) agencies. In its August 2025 alert, CISA stated that those agencies must remediate catalog vulnerabilities by the applicable due dates. CISA separately urges other organizations to prioritize timely remediation, but that recommendation does not make the directive’s deadlines binding on them.
Organizations outside the FCEB should distinguish CISA’s prioritization guidance from obligations that may apply to them under their own laws, contracts, or regulatory requirements. The relevant deadline depends on the organization’s actual obligations, not simply on a vulnerability appearing in KEV.
Where prevention and AI fit into the picture
Downstream patching is not the only way to reduce vulnerability risk. CISA and the FBI’s January 2025 updated Product Security Bad Practices guidance is voluntary and directed to software manufacturers; it encourages security to be prioritized throughout product development. That is a prevention-side complement to organizational remediation, not a measurement of how quickly vulnerabilities are discovered or repaired.
Free tools Windows power users keep installed
One-click scans. No signup required.
CISA’s August 2026 announcement about its FY 2024–2025 Vulnerability Review presents the review as a baseline for understanding the vulnerability landscape before AI-enabled discovery becomes more widespread. The announcement does not quantify an AI-driven increase in vulnerability discovery or show that AI caused remediation backlogs to grow. It is not evidence for a measured widening of the discovery–repair gap.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
