A critical CVE drops at 9:00 AM. Automated exploitation begins at 11:00 AM. Your patch cycle runs every 30 days.
You normalized a 29-day exposure window. Attackers measured it. They built tooling around it.
Average time to patch critical vulnerabilities: 60 days. Average time to exploitation after disclosure: 5 days. In 2025, 29,000 new CVEs were published. 79 per day.
WHY PROGRAMS FAIL
- VOLUME WITHOUT PRIORITIZATION Enterprises carry 1,000 to 3,000 open vulnerabilities at any time. A single queue creates paralysis. Teams triage instead of remediate. The backlog is not laziness. It is the absence of a framework.
- CVSS MISUSE CVSS measures theoretical severity — not actual risk in your environment. A CVSS 9.8 on software you do not run is less urgent than a CVSS 7.2 on an internet-facing system with active exploitation confirmed in the wild.
- ASSET INVENTORY GAPS You cannot patch what you cannot see. Shadow IT. Forgotten cloud instances. Inherited infrastructure. Attackers find what your scanner missed. That asset becomes their entry point.
- PATCH TESTING DELAYS Patches wait in change management queues. Exploitation begins within 48 hours of disclosure. Your process guarantees exposure during your own testing window.
HOW TO REDUCE REAL RISK
- RISK-BASED PRIORITIZATION CVSS — Theoretical severity and attack vector. EPSS — Probability of exploitation within 30 days. Updated daily. A CVSS 9.0 with EPSS 0.3% is lower priority than a CVSS 6.5 with EPSS 87%. CISA KEV — Known Exploited Vulnerabilities. Actively weaponized right now. Every entry gets patched immediately. No queue. No delay.
- TIERED SLAs CRITICAL + KEV: 24 hours. Emergency process. No exceptions. CRITICAL (CVSS 9.0+, EPSS >50%): 72 hours. HIGH (EPSS >10%): 7 days. MEDIUM: 30 days.
Publish SLAs. Measure compliance weekly. Report to leadership monthly. A program without measurement is guesswork.
- COMPENSATING CONTROLS When patching is impossible — OT, legacy systems, critical dependencies — compensating controls are mandatory. Network segmentation. WAF virtual patching. Enhanced monitoring. Document each with a remediation deadline. Temporary by definition.
- ATTACK SURFACE REDUCTION Every system decommissioned is a vulnerability you never have to patch. Every library removed eliminates its entire CVE history. Build and maintain an SBOM for every application. When a CVE drops, identify exposure in minutes — not days.
- METRICS THAT MATTER Mean Time to Remediate by tier. SLA compliance rate. Exposure window post-disclosure.
Report risk reduction — not raw vulnerability counts. Leadership acts on trends, not totals.
The goal is closing what attackers are using before they reach you. Your adversaries track your patch velocity. Track it yourself first.
What is your SLA for critical vulnerability remediation? When did you last measure actual compliance against it?