CISA KEV Data Reveals Human-Scale Security Gaps
▼ Summary
– The average time-to-exploit for critical vulnerabilities is now negative seven days, meaning they are often weaponized before a patch exists.
– Despite teams closing 6.5 times more vulnerability tickets, the percentage of critical flaws still open after seven days has worsened from 56% to 63%.
– For 88% of studied weaponized vulnerabilities, the remediation process was slower than the exploitation, with responses often taking hundreds of days.
– The core problem is a broken operational model, as human-driven processes create a “Manual Tax” and cannot scale to meet autonomous AI-powered threats.
– Defense must shift to autonomous, closed-loop risk operations that remove human latency, as the current scan-and-report model is mathematically obsolete.
New data reveals a fundamental mismatch in cybersecurity. While defenders work harder than ever, the operational model itself is broken, creating a widening gap that human effort alone cannot close. Analysis of four years of CISA KEV remediation data shows that despite teams closing 6.5 times more tickets, the percentage of critical vulnerabilities still open after a week has actually worsened. The core issue is not a lack of speed or staffing, it is a structural flaw in how security is practiced.
Recent research examining over a billion remediation records confirms a troubling trend. The average Time-to-Exploit has collapsed to negative seven days, meaning attackers often weaponize flaws before a patch even exists. In this environment, simply counting patched vulnerabilities is a dangerous distraction. The real metric of danger is cumulative exposure, which accounts for both the number of vulnerable assets and the duration they remain at risk.
Consider the evidence from tracked, weaponized vulnerabilities. A staggering 88 percent were patched more slowly than they were exploited. For instance, the Spring4Shell vulnerability was actively exploited two days before public disclosure, yet the average enterprise required 266 days to fully remediate it. This pattern repeats consistently, demonstrating that defenders are operating on a timeline of seasons while attackers move in days. This discrepancy is not an intelligence failure, it is a profound operationalization failure.
The current system imposes a severe Manual Tax. This is the multiplier effect where hard-to-reach, long-tail assets extend risk from weeks into many months. While median remediation times might appear manageable, averages tell the true story of prolonged exposure. For infrastructure vulnerabilities like the one in Cisco IOS XE, even the median remediation time stretched to 232 days. When the best possible outcome is over seven months, the manual tax is no longer an inefficiency, it is the unacceptable baseline.
This gap is poised to widen dramatically with the rise of autonomous AI agents. Cybersecurity has historically evolved as a reaction to new technology, but AI represents a different kind of shift. It transforms the adversary’s capabilities, enabling offensive operations that move faster than any human-staffed security team can possibly respond. The most dangerous period for the industry is this transition window, where AI-powered attackers are met with human-speed defenders.
The traditional scan-and-report model is obsolete. Built for a slower era with fewer vulnerabilities, its discover-score-ticket-manual route workflow cannot scale. The future requires an end-to-end Risk Operations Center. This approach integrates embedded, machine-readable intelligence, uses active confirmation to validate actual exploitability in a specific environment, and employs autonomous action to compress response times to match the threat. The goal is to elevate human expertise from tactical execution to strategic governance, directing automated systems rather than performing manual tasks.
Organizations that are succeeding today are not doing so with larger teams. They are winning by systematically removing human latency from the critical path. As exploit timelines remain negative and vulnerability volumes continue to climb, the reactive model has hit a hard mathematical limit, often called the human ceiling. The pressing question is whether enterprises will adopt an architectural shift that aligns with this new mathematical reality, closing the window of risk before it closes for good.
(Source: BleepingComputer)
