Remediation Paradox: More Patching, Less Coverage | Qualys
Summary: Qualys Threat Research Unit found that vulnerability closures rose from 73 million in 2022 to 473 million in 2025, a 6x increase, while the share of critical vulnerabilities still open at day seven rose from 56% to 63%. The research attributes this to effort allocated by volume and severity score rather than evidence of exploitation, and reports mean time to exploitation at -7 days against a mean time to remediate of +30 days.
Bottom line: Less than 1% of vulnerabilities are actively exploited, so a program built on volume and CVSS spends most of its work on findings attackers were never going to use - and manual remediation failed to keep pace with attackers 88% of the time on the most critical, actively exploited vulnerabilities over four years.
Read the original at Qualys Blog ↗
- Topics
- Governance, Risk & Compliance
- Related
- Upcoming Speaking Engagements Cyber Risks · Nov 14, 2026Friday Squid Blogging: Pacific Flying Squid Populations Dropping in Korean Waters Cyber Risks · Nov 13, 2026AI Doesn’t Have to Go Rogue to Break the World Cyber Risks · Nov 13, 2026