Threat Research Report: The Broken Physics of Remediation | Qualys
Summary: A Qualys research study analyzing over one billion CISA KEV remediation records across 10,000 organizations from 2022 through 2025 found that manual remediation failed to keep pace with attackers 88% of the time on the most critical, actively weaponized vulnerabilities, and that half of those were weaponized before a patch existed. The study reports that 15% of organizations that operationalized their remediation pipeline patched by the point of KEV addition, and introduces metrics including Average Window of Exposure, Risk Mass, the Manual Tax, and the confirmation gap.
Key Takeaway: For a single CVE like Follina, Risk Mass reached 33,000 exposure-days, with 80% of that exposure occurring outside the sprint that dashboards actually capture - so the reporting most teams rely on is blind to most of the risk they carry.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026