time-to-exploit for newly disclosed vulnerabilities collapsed

The median time-to-exploit for newly disclosed vulnerabilities collapsed from 63 days in 2018 to just 5 days in 2025. Organizations still take a median of 32 days to patch, which means the average critical vulnerability sits exposed for nearly a month after attackers have already weaponized it.