Organizations that remediate vulnerabilities in 4–7 days are breached by a known vulnerability at a 97% rate.

Organizations that patch vulnerabilities within 24 hours are breached by a known vulnerability at a 77% rate.

Exploited high and critical severity vulnerabilities increased 105% from 71 in 2024 to 146 in 2025.

Log4j generated 824.9 million IPS hits in 2025.

Mean time to exploit vulnerabilities was -7 days, indicating exploitation routinely occurs before patches are released.

2% of cybersecurity intrusions investigated involved vulnerability exploitation.

Vulnerability exploitation accounted for 40% of incidents observed by IBM X‑Force in 2025.

Vulnerability exploitation accounted for 41.8% of observed application-layer attacks, rising to nearly 58% in Q4 2025.

Vulnerability exploitation led to malware deployment as a follow-up activity in 68% of cases.

Vulnerability exploitation accounted for 21.3% of initial access vectors.