[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fARqgS9P3-KOzmBhofO_oEcp7qKdSSBcNLg2eFA2cWiI":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"995ee53d-68a8-4ce7-95a0-e979b9780ba9","The Real Jump Scare Isn’t the Attacker; It’s The Vulnerabilities You’re Focusing On","the-real-jump-scare-isn-t-the-attacker-it-s-the-vulnerabilities-you-re-focusing-50c77a","Key Takeaways Teams are remediating more than ever, but exposure from the vulnerabilities that matter is still rising faster than they can keep up with. Mean time to exploitation is about −7 days. Mean time to remediate sits around +30 days. Qualys research: closures rose from 73M (2022) to 473M (2025) – 6× – while […]","Despite increased remediation efforts, organizations are struggling to keep pace with the accelerating threat landscape. Mean time to exploitation is now -7 days, meaning vulnerabilities are weaponized a week before defenders can deploy patches, which take an average of 30 days to remediate. This paradox is exacerbated by AI-driven attacks, leading to higher breach costs and a focus on volume and severity over actively exploited threats.","Vulnerability exposure is rising faster than remediation efforts, with exploitation occurring before patches are","https:\u002F\u002Fblog.qualys.com\u002Fqualys-insights\u002F2026\u002F10\u002F20\u002Fremediation-paradox-cybersecurity-awareness-month","https:\u002F\u002Fblog.qualys.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fcropped-1.png","2026-10-20T19:08:51+00:00","2026-10-20T20:00:10.546935+00:00",8,[17,20],{"name":18,"type":19},"AI","technology",{"name":21,"type":22},"Qualys","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21],{"controls":44,"vendors":131},[45,74,103],{"slug":46,"name":47,"problem":48,"products":49},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":75,"name":76,"problem":77,"products":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":40,"name":104,"problem":105,"products":106},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[132],{"slug":133,"name":21,"logo_path":134,"roles":135},"qualys","\u002Fvendor-logos\u002Fqualys.png",[136],"reported_by",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"exploitation-outpaces-patching-as-mean-time-to-exploit-drops-to--7-days","Exploitation Outpaces Patching as Mean Time to Exploit Drops to -7 Days","Organizations are losing the race against threat actors because vulnerabilities are now weaponized an average of seven days before defenders even begin remediation — and patches still take roughly 30 days to deploy at scale. The core failure is a strategic one: security teams are prioritizing vulnerability volume and severity scores (like CVSS) rather than focusing resources on flaws that are actively being exploited in the wild. AI-driven attack tooling is compressing attacker timelines further, meaning the traditional patch-cycle model is structurally broken. This matters because even a well-resourced team applying 'best practice' patching cadences is now operating a week behind the threat, guaranteeing a window of exposure. Without a shift toward exploitation-driven prioritization and automation, breach costs and incident frequency will continue to rise.",[142,143,144,145,146,147,148],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":150,"PCI DSS Requirement 6":151,"NIST SP 800-53 SI-2: Flaw Remediation":152,"OWASP A06:2021 Vulnerable and Outdated Components":153,"CIS Control 7: Continuous Vulnerability Management":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"NIS2 requires essential and important entities to implement risk-proportionate technical measures including vulnerability handling and disclosure; the article's scenario of exploitation outpacing patching represents a direct failure of this obligation.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching and vulnerability management processes, making the 30-day average remediation lag a direct compliance gap for in-scope environments.","SI-2 mandates the identification and remediation of flaws within organizationally defined timeframes; had time-bound SLAs tied to exploitation evidence been enforced, the 30-day average patch lag would have been structurally prevented.","This risk category directly captures the failure mode described — attackers weaponizing known vulnerabilities in unpatched components faster than defenders can respond — and prescribes continuous monitoring of component vulnerability status.","This control explicitly requires organizations to continuously assess, prioritize, and remediate vulnerabilities — directly addressing the failure to focus on actively exploited flaws over severity-scored backlogs.","This control requires timely identification and remediation of technical vulnerabilities, including assessing exposure and taking appropriate action — precisely the risk-informed, exploitation-aware prioritization model the article identifies as missing.","While primarily an access control reference, the CSF Protect function more broadly requires that exposure windows be minimized through timely protective measures, reinforcing why compensating controls must be applied when patching lags behind exploitation timelines."]