AI-assisted exploit development compressed the average time from vulnerability disclosure to a working exploit from 125.3 days in January 2025 to 0.5 days by April 2026.

55.7% of critical CVEs never received scanner coverage at all.

62.0% of critical vulnerabilities with known exploits had a working exploit available before scanner detection signatures shipped.

54.0% of CVEs published since January 2025 had no detection signature from Tenable, Qualys, or Rapid7.

Median detection lag from vulnerability disclosure was 0.1 days for Tenable, 2.9 days for Qualys, and 5.1 days for Rapid7.

Exploits appeared before scanner detection for 62.5% of critical CVEs at Tenable, 64.5% at Qualys, and 73.5% at Rapid7.

44.3% of critical CVEs received scanner coverage.

83.2% of critical vulnerabilities either lacked scanner coverage entirely or had exploits appear before detection ships.

Midmarket organizations average 56 days to remove exposures, nearly four times slower than smaller enterprises.

Since 2023, the share of organizations deploying patches within six days has nearly quadrupled, rising from 15% to 59%.

Attackers exploited vulnerabilities an average of seven days before public disclosure in 2025.

Automation is the top patch modernization investment priority for 76% of organizations in 2026.

86% of organizations say vulnerability remediation is a critical part of their security strategy.

74% of organizations cite coordinating vulnerability prioritization and remediation as their biggest security issue.

74% of IT and security professionals have experienced vulnerabilities in third-party applications.

56% worry they remain exposed to known vulnerabilities, even as 86% say remediation is a critical part of their security strategy.

56% of organizations remain concerned they are still exposed to known vulnerabilities that have not yet been remediated in their environments.

56% of leaders lack a full view of risks and vulnerabilities within business systems.

Retail firms average 10 days to remediate exposures.

49% of organizations include third-party applications in their current patching process.