Time-to-exploit is shrinking fast, but are patch programs keeping up?

TL;DR: Patch windows have collapsed from roughly 32 days to 5 days, with 32.1% of vulnerabilities exploited on or before disclosure and 50-61% weaponized within 48 hours, according to Pixee's analysis of 2025 exploitation trends. The practical consequence is that vulnerability management must shift from compliance-led patching to exploitability-led remediation and compromise hunting.

NHIMG editorial — based on content published by Pixee: Time-to-Exploit Has Collapsed. Has Your Remediation Strategy?

By the numbers:

• In 2024, organizations had roughly 32 days between vulnerability disclosure and active exploitation, but that window has shrunk to 5 days.
• In H1 2025, 32.1% of vulnerabilities were exploited on or before the day they were publicly disclosed.
• Attackers weaponized 50-61% of vulnerabilities within 48 hours, according to Pixee's analysis.

Questions worth separating out

Q: What breaks when vulnerability discovery is faster than patch cycles?

A: Patch-centric programmes break because they assume security teams have days or weeks to assess, approve, and deploy fixes.

Q: Why do exposed systems remain risky even after the patch is installed?

A: Because attackers may already have established persistence before remediation completed.

Q: How do security teams know whether Teams remediation is working?

A: They should measure dwell time, removal latency, and the percentage of malicious messages removed before any user interaction.

Practitioner guidance

• Prioritise exploitable vulnerabilities first Rank remediation by active exploitation, internet exposure, and asset criticality before severity score.
• Assume pre-patch compromise on exposed assets For any system reachable during the exploit window, validate logs, running processes, scheduled tasks, backdoors, and persistence artefacts before declaring remediation complete.
• Separate patching from eradication Treat patch deployment, compromise confirmation, and attacker eviction as distinct workflow stages so a fixed system is not mistaken for a clean one.

What's in the full article

Pixee's full analysis covers the operational detail this post intentionally leaves for the source:

• A deeper breakdown of the Fortinet exploitation timeline, including the specific patch-to-zero-day sequence.
• Practical distinctions between patch deployment, compromise validation, and attacker eviction in remediation workflows.
• The source article's reasoning on why exploitability should outrank severity in prioritisation.
• The weekly AppSec framing behind remediation velocity and backlog reduction, which is useful for programme owners.

👉 Read Pixee's analysis of the collapsing time-to-exploit window in AppSec →

Time-to-exploit is shrinking fast, but are patch programs keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →