Grey Noise Intelligence Releases New Report Outlining How Cyber Threat Activity Precedes Vulnerability Disclosure
Summary: GreyNoise Intelligence released a report titled "Ten Days Before Zero" analyzing traffic on its Global Observation Grid over 103 days and 147.8 million sessions, measuring daily activity on 276 tags tied to 18 common edge device and network infrastructure vendors. It found that over half of identified activity surges were followed by a vendor-matched CVE disclosure within three weeks, with a median lead time of 11 days.
What's compelling: A median 11-day gap between an activity surge and the matching CVE disclosure is the window in which attackers may already be operating while defenders have no advisory to act on - and blocking the associated IPs during that phase may keep an organization out of attacker inventories built for exploitation weeks later.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026