Attackers Exploit 71% of Critical Flaws Within a Week of Disclosure
Written by AI from the linked story. Not reviewed by an editor. How this works
Rapid7's findings confirm that the window between vulnerability disclosure and active exploitation has collapsed to an average of just three days, rendering traditional monthly or quarterly patching cycles dangerously inadequate. Organizations that rely on fixed patching schedules are effectively handing attackers a guaranteed head start. This matters because high-severity vulnerabilities are the primary entry point for ransomware groups and state-linked threat actors targeting critical infrastructure. The speed of exploitation means that detection and response capabilities must be as mature as patching processes — finding a vulnerability after attackers have already weaponized it is too late.
Tactical Insight
Immediate actions
- Implement an emergency/out-of-band patching procedure specifically for CVSS 9.0+ or actively exploited vulnerabilities, with a target remediation window of 24–72 hours from disclosure.
- Subscribe to real-time vulnerability intelligence feeds (e.g., CISA KEV, vendor advisories) and configure automated alerts so security teams are notified the moment a critical flaw is published.
- Perform an immediate audit of all internet-facing and externally accessible assets to prioritize exposure to newly disclosed vulnerabilities.
Long-term improvements
- Build and maintain a continuously updated asset inventory tied to a vulnerability management platform so patching scope can be determined within hours of a new disclosure.
- Adopt a risk-based patching policy that tiered by exploitability, asset criticality, and internet exposure rather than a uniform calendar schedule.
- Invest in network segmentation to limit lateral movement and blast radius in the event a vulnerability is exploited before a patch can be applied.
Detection measures
- Deploy continuous vulnerability scanning on all internet-facing systems, scheduled at least daily, to detect unpatched exposures as soon as signatures are updated.
- Integrate threat intelligence on active exploitation campaigns into SIEM and EDR tooling so defenders can detect exploitation attempts targeting unpatched systems in real time.