Notifications
Clear all
Topic starter
20/08/2026 5:56 pm
TL;DR: Patch windows have collapsed from roughly 32 days to 5 days, with 32.1% of vulnerabilities exploited on or before disclosure and 50-61% weaponized within 48 hours, according to Pixee's analysis of 2025 exploitation trends. The practical consequence is that vulnerability management must shift from compliance-led patching to exploitability-led remediation and compromise hunting.
NHIMG editorial — based on content published by Pixee: Time-to-Exploit Has Collapsed. Has Your Remediation Strategy?
By the numbers:
- In 2024, organizations had roughly 32 days between vulnerability disclosure and active exploitation, but that window has shrunk to 5 days.
- In H1 2025, 32.1% of vulnerabilities were exploited on or before the day they were publicly disclosed.
- Attackers weaponized 50-61% of vulnerabilities within 48 hours, according to Pixee's analysis.
Questions worth separating out
Q: What breaks when vulnerability discovery is faster than patch cycles?
A: Patch-centric programmes break because they assume security teams have days or weeks to assess, approve, and deploy fixes.
Q: Why do exposed systems remain risky even after the patch is installed?
A: Because attackers may already have established persistence before remediation completed.
Q: How do security teams know whether Teams remediation is working?
A: They should measure dwell time, removal latency, and the percentage of malicious messages removed before any user interaction.
Practitioner guidance
- Prioritise exploitable vulnerabilities first Rank remediation by active exploitation, internet exposure, and asset criticality before severity score.
- Assume pre-patch compromise on exposed assets For any system reachable during the exploit window, validate logs, running processes, scheduled tasks, backdoors, and persistence artefacts before declaring remediation complete.
- Separate patching from eradication Treat patch deployment, compromise confirmation, and attacker eviction as distinct workflow stages so a fixed system is not mistaken for a clean one.
What's in the full article
Pixee's full analysis covers the operational detail this post intentionally leaves for the source:
- A deeper breakdown of the Fortinet exploitation timeline, including the specific patch-to-zero-day sequence.
- Practical distinctions between patch deployment, compromise validation, and attacker eviction in remediation workflows.
- The source article's reasoning on why exploitability should outrank severity in prioritisation.
- The weekly AppSec framing behind remediation velocity and backlog reduction, which is useful for programme owners.
👉 Read Pixee's analysis of the collapsing time-to-exploit window in AppSec →
Time-to-exploit is shrinking fast, but are patch programs keeping up?
Explore further
20/08/2026 6:36 pm
Exploitability has replaced patch status as the more useful security signal. When 32% of vulnerabilities are weaponized on disclosure day, patch completion becomes a lagging indicator rather than a risk control. Security teams need response models that rank exposed and actively exploited assets ahead of unexploited backlog. The practitioner takeaway is to make exploitability the primary triage lens, not the compliance dashboard.
A question worth separating out:
Q: Who is accountable when compromised access infrastructure keeps working after patching?
A: Accountability sits across platform owners, IAM teams, and security operations because patching alone does not remove persistence or confirm that access state has been cleaned up. Frameworks that matter here include least-privilege and configuration management controls, plus the operational responsibility to verify that no unauthorized access path survives remediation.
👉 Read our full editorial: Time-to-exploit has collapsed: remediation strategy now lags reality
