Ten Days Before Zero: How Activity Surges in Grey Noise Data Precede Vulnerability Disclosure

Summary: GreyNoise reports that activity surges in its sensor data precede vulnerability disclosures by a median of 11 days, a pattern it says held across 33 CVEs and 16 vendor families and was confirmed by statistical testing. The study tracked 147.8 million sessions across 18 vendors over 103 days and identified 68 pre-disclosure surges, documenting countdown compression patterns, infrastructure concentration shifts, and attack-type progressions ahead of public CVE advisories.
Why it matters: Across 68 observed surges, activity was already moving a median of 11 days before the advisory existed, so a patch-and-publish timeline leaves attackers roughly a week and a half of head start on the CVEs in this sample.

Read the original at GreyNoise Blog ↗