Topic starter
20/08/2026 5:56 pm
TL;DR: Patch windows have collapsed from roughly 32 days to 5 days, with 32.1% of vulnerabilities exploited on or before disclosure and 50-61% weaponized within 48 hours, according to Pixee's analysis of 2025 exploitation trends. The practical consequence is that vulnerability management must shift from compliance-led patching to exploitability-led remediation and compromise hunting.
Editorial analysis by NHI Mgmt Group, based on content published by Pixee: “Time-to-Exploit Has Collapsed. Has Your Remediation Strategy?”.
By the numbers:
- Time-to-exploit has fallen from roughly 32 days in 2024 to 5 days today, according to Pixee.
- 32.1% of vulnerabilities were exploited on or before the day they were publicly disclosed, according to Pixee.
- 50-61% of vulnerabilities had exploit code weaponized within 48 hours, according to Pixee.
Key questions
Q: What breaks when patching is slower than exploit weaponisation?
A: The assumption that remediation will finish before abuse does.
Q: Why do fully patched systems still need compromise hunting?
A: Because a patch only removes the vulnerable condition from that point forward.
Q: How do security teams know whether Teams remediation is working?
A: They should measure dwell time, removal latency, and the percentage of malicious messages removed before any user interaction.
Practitioner guidance
- Prioritise by exploitability, not only severity Rank vulnerabilities using active exploitation, public proof-of-concept availability, and asset exposure so the first work goes to what attackers can use now.
- Hunt for compromise after emergency patching Run targeted validation for persistence, backdoors, and changed access paths on systems exposed during the exploit window, even when the vulnerable version is gone.
- Measure remediation velocity for active threats Track the time between disclosure, mitigation, and verified exposure closure for critical vulnerabilities rather than relying on fleet-wide patch completion percentages.
Bottom line: Time-to-exploit has compressed enough that patch compliance no longer tells leaders whether the environment is actually safe.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:36 pm
Exploitability now outranks severity as the practical decision variable: the gap between disclosure and weaponization has become too short for severity-led queues to protect most environments. CVSS still helps with triage, but it does not tell teams where active adversaries are likely to strike first. Security programmes that continue to optimise for the highest score instead of the most exploitable condition will keep missing the real exposure window. Practitioners should treat exploitability intelligence as the primary remediation signal.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
A: Treat it as both when there is evidence the issue may already have been exploited, when the asset is publicly exposed, or when the impact could include partial or total control of the system. In those cases, patching alone is not enough. Teams need containment, validation, and forensic review before the case is closed.
👉 Read our full editorial: Time-to-exploit has collapsed: remediation strategy now lags reality