Notifications
Clear all
Topic starter
01/08/2026 10:45 pm
TL;DR: Among critical vulnerabilities with known exploits, 62.0% were exploited before scanner signatures shipped, while 55.7% never received coverage at all, leaving 83.2% either undetected or exploitable first, according to Cogent’s analysis of 69,159 CVEs. Signature-first visibility is no longer a reliable control boundary when exploit generation is collapsing to hours.
NHIMG editorial — based on content published by Cogent: Blog Research 62% of Critical Vulnerabilities Have Exploits Circulating Before Scanners Can Detect Them
By the numbers:
- 62.0% of critical vulnerabilities with a known exploit had that exploit circulating before any scanner released a detection signature.
- Average time between CVE publication and the first public exploit fell from 125.3 days to 0.5 days.
- 54.0% of CVEs published since January 2025 have no detection signature from any of the three scanners analyzed.
Questions worth separating out
Q: How should security teams handle critical CVEs before scanner signatures exist?
A: They should move from signature-driven response to exposure-driven response.
Q: Why do scanners miss the most dangerous vulnerabilities in time?
A: Because exploit development is compressing faster than detection engineering.
Q: What breaks when vulnerability management is limited to scan results?
A: Teams end up triaging large numbers of findings without knowing which ones can be chained into a working attack.
Practitioner guidance
- Build exposure mapping from inventory and SBOM data Use software inventory, SBOM correlation, and configuration baselines to identify likely affected assets within minutes of CVE disclosure, before scanner signatures arrive.
- Prioritise remediation by exploitability, not scan presence Treat known exploit availability, internet exposure, and privilege-bearing assets as higher priority than systems that simply failed a scanner check.
- Tie vulnerability response to identity and privilege scope Identify which vulnerable systems can reach secrets, tokens, service accounts, or administrative interfaces, then reduce privilege where possible before patching completes.
What's in the full report
Cogent's full research covers the operational detail this post intentionally leaves for the source:
- Methodology for tracking 69,159 CVEs across publication, exploit availability, and signature ship dates.
- Vendor-by-vendor median lag analysis for Tenable, Qualys, and Rapid7 across severity bands.
- Monthly trend breakdown showing how exploit timelines collapsed from 125.3 days to 0.5 days.
- Interpretive guidance on how to use inventory and SBOM correlation when scanner coverage is missing.
👉 Read Cogent's analysis of exploit timing versus scanner coverage for critical CVEs →
Critical CVEs are exploitable before scanners detect them?
Explore further
01/08/2026 10:54 pm
Signature-first vulnerability management is now a lagging control model. When exploit development moves from days to hours, scanner output becomes evidence of what was already exploitable rather than a reliable early warning system. That does not make scanners useless, but it does mean they cannot remain the primary control boundary for critical exposure decisions. Practitioners should treat signatures as one input in a broader exposure management workflow.
A question worth separating out:
Q: Who is accountable when an internet-facing server exposes a critical CVE?
A: Accountability usually spans infrastructure, platform, and application owners, because reachability, configuration, and patching all influence risk. Frameworks such as the NIST Cybersecurity Framework support that shared responsibility model by tying identify, protect, detect, and respond together.
👉 Read our full editorial: Scanner coverage lags exploit development for critical CVEs
