71% of vulnerability exploitation starts within a week of disclosure

Rapid7's findings confirm that the window between vulnerability disclosure and active exploitation has collapsed to an average of just three days, rendering traditional monthly or quarterly patching cycles dangerously inadequate. Organizations that rely on fixed patching schedules are effectively handing attackers a guaranteed head start. This matters because high-severity vulnerabilities are the primary entry point for ransomware groups and state-linked threat actors targeting critical infrastructure. The speed of exploitation means that detection and response capabilities must be as mature as patching processes — finding a vulnerability after attackers have already weaponized it is too late.