Qualys Threat Research Unit 2025
The Broken Physics
of Remediation
of Remediation
Adversaries now weaponize vulnerabilities faster than patches exist.
The operational model of remediation is structurally broken.
The operational model of remediation is structurally broken.
Based on 1 billion+ CISA KEV remediation records · 10,000+ organizations · 2022-2025
1 The Core Asymmetry
Attackers exploit in hours. Defenders remediate in weeks.
This is not a process gap — it is a physics gap.
This is not a process gap — it is a physics gap.
Avg Time-to-Exploit
-1 day
Days exploits arrive before patches do.
Defender Avg Window (AWE)
21 days
Days to close a critical vulnerability.
Defenders Lose
88%
Of weaponized CVEs patched slower than exploited.
Still Open at Day 7 (2025)
63%
Critical KEV vulns in 2025 — up from 56% in 2022.
2 Volume Explosion & The Human Ceiling
KEV vulnerability events closed per year grew 6.5× in four years — from 73M in 2022 to 473M in 2025. Teams worked harder and closed more tickets, yet the percentage of critical exposures still open at Day 7 got worse.
CISA KEV events closed per year (across 10,000+ orgs)
2022
73M
Baseline
2023
123M
+1.7x
2024
301M
+4.1x
2025
473M
+6.5x
2022
73M
Baseline
2023
123M
+1.7x
2024
301M
+4.1x
2025
473M
+6.5x
The Human Ceiling
63% of critical KEV vulnerabilities were still open at Day 7 in 2025 — up from 56% in 2022. You cannot scale a workforce 6.5× to match a 6.5× increase in exploitable risk. The constraint is not effort. It is the operational model itself.
Open at Day 7 — 2022
56%
Of critical KEV vulnerabilities still unpatched
Open at Day 7 — 2025
63%
Worse despite 6.5x more events closed
3 The Zero-Day Zone & The Manual Tax
50%
of high-profile CVEs were weaponized before disclosure.
Win Kernel EoP (CVE-2024-21338)
-182 Days
-182 Days
Avg close: -120 days
WinRAR RCE (CVE-2023-38831)
-110 Days
-110 Days
Avg close: -140 days
Cisco IOS XE
-30 Days
-30 Days
Avg close: 263 days
ActiveMQ RCE
-15 Days
-15 Days
Avg close: 459 days
Spring4Shell (CVE-2022-22965)
+2 Days
+2 Days
Avg close: 266 days
WebLogic RCE (CVE-2023-21839)
+71 Days
+71 Days
Avg close: 266 days
50%
of high-profile CVEs were weaponized before disclosure.
Win Kernel EoP
(CVE-2024-21338)
-182 Days
(CVE-2024-21338)
-182 Days
Avg close: -120 days
WinRAR RCE
(CVE-2023-38831)
-110 Days
(CVE-2023-38831)
-110 Days
Avg close: -140 days
Cisco IOS XE
-30 Days
-30 Days
Avg close: 263 days
ActiveMQ RCE
-15 Days
-15 Days
Avg close: 459 days
Spring4Shell
(CVE-2022-22965)
+2 Days
(CVE-2022-22965)
+2 Days
Avg close: 266 days
WebLogic RCE
(CVE-2023-21839)
+71 Days
(CVE-2023-21839)
+71 Days
Avg close: 266 days
The Manual Tax: median vs. average days to close
Spring4Shell
266 Days
WebLogic RCE
242 Days
F5 BIG-IP
188 Days
Jenkins CLI
146 Days
Veeam Creds
196 Days
SpoolFool
62 Days
Spring4Shell
266 Days
WebLogic RCE
242 Days
F5 BIG-IP
188 Days
Jenkins CLI
146 Days
Veeam Creds
196 Days
SpoolFool
62 Days
4 Risk Mass:
Measuring Cumulative Exposure
Risk Mass = vulnerable assets × days exposed. A CVE patched in 1 day and a CVE patched in 180 days both register as "remediated" — but one absorbed 180× more exploitable opportunity.
33,000
Exposure-Days From Follina Alone
Blind Spot
Day -30 to Day 0
~12,000 Exposure-Days 36% of Total Risk Mass
No patch existed. Nation-state actors (TA413) already exploiting. 100% of assets vulnerable. Zero remediation possible.
Sprint
Day 0 to Day 23
~6,200 Exposure-Days 19% of Total Risk Mass
Patch released. Remediation begins. By Day 7: 79% still unpatched. By Day 14: 57%. The phase that looks good on dashboards.
Long Tail
Day 23 to Day 364+
~14,600 Exposure-Days 44% of Total Risk Mass
Ransomware groups (Cl0p, LockBit 3.0) exploit the same CVE. At Day 55 avg close: 90 assets still open. At 1 year: 15 remain.
The dashboard measures Sprint (19%). Risk Mass measures everything it misses — the Blind Spot + Long Tail (81%).
5 The Sub-1% Reality & The Confirmation Gap
0.74%
of 48,172 CVEs disclosed in 2025 were remotely exploitable, actively concept weaponized, and backed by working proof-of- code.
| Year | Disclosed | Weaponized | Rate |
|---|---|---|---|
2022 | 25,043 | 131 | 0.52% |
2023 | 28,816 | 185 | 0.64% |
2024 | 39,964 | 218 | 0.55% |
2025 | 48,172 | 357 | 0.74% |
The Confirmation Gap
Even after prioritization narrows 48,172 CVEs to 357 — a second filter problem remains:
Prioritization Asks:
What is theoretically dangerous?
Confirmation Asks:
Is this actually exploitable in my environment, right now?
Compensating controls — WAF rules, network segmentation, EDR policies — may already mitigate a high-priority CVE. Confirmation testing reveals this, freeing cycles for genuinely exploitable gaps.
Prioritization reduces the haystack. Confirmation finds which needles are real.
6 Operationalize or Fail:
The Risk Operations Center
The scan-and-report model was built for lower volume, longer timelines, and acceptable human latency. That era is over. A ROC is an end-to-end pipeline that executes the full remediation lifecycle at machine speed.
1
Embedded
Intelligence
Intelligence
Threat intel arrives as machine-readable decision logic — not a report. The system auto-correlates CVEs against asset inventory, cross-references threat actor activity, assesses existing controls, and determines action priority in seconds rather than days.
2
Active
Confirmation
Confirmation
Move from version-based detection to exploit-based validation. TruConfirm tests whether the full exploit chain succeeds in the production environment — yielding a dramatically compressed confirmed target list. Resources freed from ghost risk redirect to validated exposure.
3
Autonomous
Action
Action
Policy-driven remediation on endpoints. Compensating controls — virtual patching, network containment, host isolation — for infrastructure where patch cycles span months. Humans govern the policies; they no longer execute every action.
The only variable still within the defender’s control is the speed and consistency of the remediation response. Operationalize it completely.
Source: Qualys TRU — The Broken Physics of Remediation (2026) 1B+ CISA KEV records • 10,000+ orgs • 2022-2025
© 2026 Qualys, Inc. All rights reserved.
