The Real Jump Scare Isn’t the Attacker; It’s The Vulnerabilities You’re Focusing On
Key Takeaways
- Teams are remediating more than ever, but exposure from the vulnerabilities that matter is still rising faster than they can keep up with.
- Mean time to exploitation is about −7 days. Mean time to remediate sits around +30 days.
- Qualys research: closures rose from 73M (2022) to 473M (2025) – 6× – while critical findings still open at day seven rose from 56% to 63%.
- Less than 1% of vulnerabilities are actively exploited. A volume-and-CVSS program spends most of its effort on the rest.
- 15% of organizations that operationalized the pipeline patched before a vulnerability hit the CISA KEV list.
October is here, bringing a chill in the air, spooky decorations, and, fittingly, Cybersecurity Awareness Month. It’s a timely reminder for security leaders to revisit and strengthen their strategy. The past 12 months alone show how cyber threats are getting smarter and faster.
There’s a haunting paradox that should be top of mind. Security teams are doing more vulnerability remediation than ever before. They’re patching faster, scanning deeper, and closing more tickets than any team in history, yet attackers exploit systems at an alarming rate, faster than ever before.
Fortunately, with the right cyber risk management plan, security teams can navigate the dark landscape of AI-driven attackers. But before we talk about defense, let’s outline a few of attackers’ tricks.
The Threat Landscape Is Accelerating
Ransomware is one of the leading cyber threats, rising in both frequency and cost. It now factors into 48% of breaches, up from 44% from the previous year, and attacks are projected to occur every two seconds by 2031. If that projection holds, it will put severe pressure on already strained security teams.
AI is escalating the problem rather than easing it. AI-generated attacks have increased 56% between March 2025 and February 2026, adding $1 million in cost per breach to the baseline cost. More attacks are coming, and those powered by AI make each breach more expensive to address.
The increased frequency and sophistication combined result in a spine-chilling number: mean time to exploitation is now measured at -7 days. Which means, on average, weaponization arrives a week before defenders have anything to deploy. Mean time to remediate, by comparison, sits at +30 days. The attacker’s clock starts before defenders have anything to deploy, so the defenders are already behind before their own 30-day countdown even begins. And there’s a scary price attached.
The Financial Reality
Every hour a breach remains active costs organizations roughly $1,100 in operational disruption, lost productivity, and incident response overhead, turning every minute into a running invoice. Globally, a breach averages about $5 million per incident, up 12% from last year.
The U.S. is projected to have the highest breach cost at about $11.5 million – more than twice the global average. The Middle East, Benelux, and Germany follow, with all four regions experiencing higher breach costs than the global average.
With costs escalating like this, the expectation would be that a growing volume of patching work is buying that cost down. The data says otherwise.
The Remediation Paradox
Research by the Qualys Threat Research Unit found that while the effort to address vulnerabilities went up, exposure still rose alongside it. According to the research, effort was allocated by volume and severity score instead of by evidence of what attackers were using. As a result, enterprises did far more work and ended up further behind. Closures rose from 73 million in 2022 to 473 million in 2025, a 6x increase in output, while the share of critical vulnerabilities still open at day seven rose from 56% to 63%. More effort produced less coverage where it counted.
The reason traces back to how that effort gets allocated in the first place. Less than 1% of vulnerabilities are actively exploited, which means a program built around volume and severity score spends the majority of its effort on vulnerabilities attackers were never going to use. The 6x increase didn’t close the gap since most of that work was never aimed at the 1% that mattered.
This misalignment proves detrimental for the vulnerabilities that do get weaponized. Across the most critical, actively exploited vulnerabilities over the past four years, manual remediation processes failed to keep pace with attackers 88% of the time, and half were weaponized before a patch existed. Teams were doing the work. They just weren’t always working on the right thing, at the right time.
The light in the dark here is that there are organizations winning this race. 15% of organizations that operationalized their remediation pipeline patched before the vulnerability was even added to the Known Exploited Vulnerabilities (KEV) list. This is proof that the gap isn’t fixed in place. It closes when the model changes.
As risk accelerates, the organizations that shift away from a ‘fix everything’ mindset to disciplined, continuous, business-impact-based prioritization will be prepared for the unknown. The focus should be on automated, intelligence-driven remediation that assesses risk in real time rather than adding people to a process.
The Path Forward
So what does this shift look like? It starts with context, not more volume. Remediation becomes contextual rather than sequential. Most friction between IT and security doesn’t start with the vulnerability itself. It starts when a ticket arrives without ownership data, gets validated whether or not action is warranted, and then gets reassigned before anything is fixed.
When asset context and risk intelligence route tasks before a ticket is even created, that upstream friction disappears. MTTR drops 30% and response times improve 40%. That’s what happens when decisions about what really matters get made before the backlog forms, instead of getting caught in debates once issues arise.
In a digital age where attacks are happening faster than teams can keep up, the teams still haunted by their own remediation metrics are the ones still asking the old questions: how many vulnerabilities can we close? What’s the CVSS score? How long before we remediate? The organizations that are getting safer are asking a different set of questions: Is this actively being exploited? What’s the evidence? Which assets are at risk? What can we automate?
As we recognize Cybersecurity Awareness Month, it’s crucial to remember that diligence is non-negotiable; the real key lies in prioritizing the vulnerabilities that wield the greatest impact.
Scary Stats That Will Keep You Up At Night
- Ransomware is rising in both frequency and cost. It now factors into 48% of breaches, up from 44% from the previous year, and attacks are projected to occur every two seconds by 2031.
- AI-generated attacks have increased 56% between March 2025 and February 2026, adding $1 million in cost per breach to the baseline cost.
- Mean time to exploitation is now measured at -7 days. Mean time to remediate, by comparison, sits at +30 days.
- Every hour a breach remains active costs organizations roughly $1,100 in operational disruption, lost productivity, and incident response overhead. Globally, a breach averages about $5 million per incident, up 12% from last year.
- The U.S. is projected to have the highest breach cost at about $11.5 million – more than twice the global average.
- The Middle East, Benelux, and Germany follow, with all four regions experiencing higher breach costs than the global average.
- Research by the Qualys Threat Research Unit found that effort was allocated by volume and severity score instead of by evidence of what attackers were using. Closures rose from 73 million in 2022 to 473 million in 2025, a 6x increase in output, while the share of critical vulnerabilities still open at day seven rose from 56% to 63%.
- Less than 1% of vulnerabilities are actively exploited.
- A program built around volume and severity score spends the majority of its effort on vulnerabilities attackers were never going to use.
- Across the most critical, actively exploited vulnerabilities over the past four years, manual remediation processes failed to keep pace with attackers 88% of the time, and half were weaponized before a patch existed.
References
- Verizon. “2026 Data Breach Investigations Report.” July 29, 2026. https://www.verizon.com/business/resources/reports/dbir/?CMP=OOH_SMB_OTH_22222_MC_20200501_NA_NM20200079_00001#key-resources
- Astra. “State of continuous pentesting report 2026.” June 2026. https://www.getastra.com/reports/state-of-pentesting
- IBM. “Cost of a Data Breach Report 2026.” July 29, 2026. https://www.ibm.com/reports/data-breach?utm_medium=OSocial&utm_source=Youtube&utm_content=RSRWW&utm_id=YT-201-CODB-2026
- Mandiant. “M-Trends 2026 Report: Real-world investigations and actionable defense insights.” March 23, 2026. https://cloud.google.com/security/resources/m-trends
- Statista. “Average cost of a data breach worldwide from March 2024 to February 2026, by country or region.” July 2026. https://www.statista.com/statistics/463714/cost-data-breach-by-country-or-region/
Frequently Asked Questions (FAQs)
Q: What is the remediation paradox?
A: Organizations are closing far more vulnerabilities, Qualys research shows a 6× rise in closures from 2022 to 2025, while a larger share of critical findings remain open at day seven. More effort has not produced better coverage of the exposures attackers use.
Q: What does mean time to exploitation of −7 days mean?
A: On average, weaponization arrives about a week before defenders have a deployable fix, so the defender’s clock starts already behind.
Q: Why not just fix everything?
A: Less than 1% of vulnerabilities are actively exploited. A program built on volume and CVSS spends most of its effort on findings attackers were never going to use.
Q: What should teams ask instead?
A: Is this actively exploited? What is the evidence? Which assets are at risk? What can be automated?
Q: Did any organizations beat the clock?
A: Yes. Qualys research found 15% of organizations that leveraged autonomous remediation patched before a vulnerability was added to the CISA KEV list.