RESEARCH · NOVEMBER 13, 2026

Minutes versus months

How fast does an exploited vulnerability become an incident — and how far behind runs the patch cycle? This brief tracks twelve months of evidence, November 2025 through November 2026, across the industry's primary reporting and CISA's exploited-vulnerabilities catalog, recomputed directly from the feed.

Four numbers carry the story. Attackers hand off access in a median 22 seconds and break out to other systems in 29 minutes. 31% of breaches now begin with an exploited vulnerability — the most common way in. The federal remediation deadline for exploited flaws has fallen from 21 days to 3. And the median organization still takes 43 days to fully remediate one. The patch cycle cannot close a window measured in minutes; detection and automated containment inside the first hour can.

Every figure in the brief carries an evidence label: V — checked against the primary source, or recomputed from primary data. R — reputable press only. E — inference. Where a claim did not survive checking as first worded, the brief says so rather than repeating it. Method and the full source list are in the appendix.

The brief

Minutes versus months — cover — MINUTES VERSUS MONTHS — COVER

Executive summary — four numbers carry the story — EXECUTIVE SUMMARY — FOUR NUMBERS CARRY THE STORY

The gap — attacker minutes against defender months, one logarithmic scale — THE GAP — ATTACKER MINUTES AGAINST DEFENDER MONTHS, ONE LOGARITHMIC SCALE

The way in — exploited vulnerabilities are now the most common initial vector — THE WAY IN — EXPLOITED VULNERABILITIES ARE NOW THE MOST COMMON INITIAL VECTOR

Time to exploit — Mandiant's average fell from 63 days to minus 7 — TIME TO EXPLOIT — MANDIANT'S AVERAGE FELL FROM 63 DAYS TO MINUS 7

The regulator's deadline — from 21 days to 3 — THE REGULATOR'S DEADLINE — FROM 21 DAYS TO 3

Public exploit code — a PoC within a day for twice as many exploited CVEs — PUBLIC EXPLOIT CODE — A POC WITHIN A DAY FOR TWICE AS MANY EXPLOITED CVES

Cases — four flaws exploited within hours to days of disclosure — CASES — FOUR FLAWS EXPLOITED WITHIN HOURS TO DAYS OF DISCLOSURE

Confirmation speed — six in ten exploited CVEs catalogued within 30 days — CONFIRMATION SPEED — SIX IN TEN EXPLOITED CVES CATALOGUED WITHIN 30 DAYS

Where it concentrates — edge devices lead; the AI and developer stack grew fastest — WHERE IT CONCENTRATES — EDGE DEVICES LEAD; THE AI AND DEVELOPER STACK GREW FASTEST

Zero-days and n-days — 8 to 11 a month, and roughly double — ZERO-DAYS AND N-DAYS — 8 TO 11 A MONTH, AND ROUGHLY DOUBLE

Scale — ransomware volume, third-party exposure and breach cost all rose — SCALE — RANSOMWARE VOLUME, THIRD-PARTY EXPOSURE AND BREACH COST ALL ROSE

AI on both sides — discovery at scale, attacker use confirmed once — AI ON BOTH SIDES — DISCOVERY AT SCALE, ATTACKER USE CONFIRMED ONCE

Implications — the controls that count now work in minutes — IMPLICATIONS — THE CONTROLS THAT COUNT NOW WORK IN MINUTES

Appendix — method and evidence labels — APPENDIX — METHOD AND EVIDENCE LABELS

Appendix — sources, 1 of 2 — APPENDIX — SOURCES, 1 OF 2

Appendix — sources, 2 of 2 — APPENDIX — SOURCES, 2 OF 2

The Lab at Milton — ideas, realized — THE LAB AT MILTON — IDEAS, REALIZED

Questions about the method, or want the underlying recomputations? Write to the barn.

← ALL RESEARCH