Three Days to Exploitation Redefines What Timely Remediation Means

Attackers have stopped waiting for your change window. The newest Rapid7 Quarterly Threat Landscape Report finds that high-severity vulnerabilities (CVSS 7 to 10) were exploited an average of 3 days after public disclosure, and that 71 percent of the tracked exploitation happened inside the first week. If your remediation program runs on a 30-day cadence, the exploitation window for a flaw like that may have closed long before your ticket reaches the top of the queue.

That is a security problem, but for a CISO or a chief compliance officer it is also a liability problem. Regulations and contracts have always demanded that organizations fix flaws in a “timely” manner. For years, timely meant whatever an auditor would accept. Now attacker behavior is writing the definition, and the gap between the two is where legal exposure, failed assessments, and breach costs accumulate.

This post unpacks the Rapid7 findings with some care, because the details matter. We separate what the data shows from what it cannot show, connect it to the standards that govern remediation, and look at what it means for the systems that move your most sensitive data. The goal is not to tell you to patch faster, which you already know. The goal is to help you build a program that can prove, with evidence, that its decisions about exposure were defensible.

Key Takeaways

1. Attacker speed now sets the meaning of timely.

With exploitation averaging about three days after disclosure for tracked high-severity flaws, a remediation window measured in weeks is difficult to defend.

2. The most dangerous flaws need no help from your users.

Of 43 newly exploited high and critical vulnerabilities, 34 required neither authentication nor user interaction, so training and credential hygiene cannot offset slow remediation.

3. Exposure belongs in days, not adjectives.

Boards and auditors respond to a risk appetite expressed as days of exposure, and that number is only credible if your logs can prove it.

4. Ransomware pressure is shifting toward government and its suppliers.

Government-sector incidents among the top 10 reporting countries rose from 48 to 55, which raises the stakes for any contractor that exchanges data with public agencies.

5. Externally reachable data exchange systems deserve first priority.

File transfer, secure email, and managed file transfer platforms sit on the internet by design, so they belong at the front of any exposure-based patching queue.

What Rapid7 Measured, and What It Did Not

Before building policy on a statistic, it pays to understand its boundaries. Rapid7 drew its findings from its own managed detection and response, vulnerability intelligence, and threat research telemetry. That is a rich dataset, but it is a vendor dataset and not a random sample of every organization on earth.

The headline numbers are also cumulative. Rapid7 reports that 71 percent of tracked exploitation happened within 7 days of disclosure, 80 percent within 14 days, and 90 percent within 30 days. The 3-day figure is an average across a narrow population, namely high-severity vulnerabilities that were exploited during the quarter. It does not mean that every high-severity flaw is attacked within 72 hours. Most are never exploited at all.

Scale matters here too. Rapid7 tracked 43 newly exploited high and critical vulnerabilities in the quarter, down 7 percent from the prior quarter and up 19 percent year over year. Forty-three is a small number, and small samples swing. A single busy campaign could move the average by a day.

So why should a careful reader still take the finding seriously? Because the direction agrees with independent evidence. In its published FAQ, CISA says that of the exploited vulnerabilities it tracks, 42 percent were used on the day of disclosure, 50 percent within two days, and 75 percent within 28 days. Two very different data collectors, one consistent message. Exploitation is front-loaded, and the first week is when most of the damage is decided.

Why Timely Is Becoming a Number Auditors Will Ask For

The phrase “in a timely manner” appears throughout security frameworks, and it rarely comes with a number. NIST SP 800-171 Rev 2, requirement 3.14.1, says to “identify, report, and correct system flaws in a timely manner.” It does not define timely as a count of days. Contractors who handle controlled unclassified information must implement that requirement under DFARS 252.204-7012, which means every defense supplier signs up to a standard whose key word is left to interpretation.

Interpretation is where the exposure lives. When an assessor, a prime contractor, or a regulator asks whether your flaw remediation was timely, they will reach for a benchmark. The benchmark they find will increasingly be attacker timelines like the ones Rapid7 documents. An organization that took six weeks to correct an actively exploited flaw may find it hard to argue that six weeks was reasonable when the public record shows most exploitation lands in the first seven days.

There is one clear numeric anchor. CISA’s Binding Operational Directive 22-01 requires federal civilian agencies to remediate vulnerabilities in its Known Exploited Vulnerabilities catalog within two weeks for CVEs assigned in 2021 or later. The directive does not bind private companies, and it is worth being precise about that. Still, CISA encourages every organization to prioritize the catalog, and a two-week default from the government’s own cyber agency is the kind of number an auditor remembers.

This is why compliance leaders should treat remediation speed as an evidence question. Reviewing your NIST 800-171 compliance posture means asking whether you can show, for each exploited flaw that touched your environment, when you learned of it, when you decided, and when you fixed it. Teams working toward CMMC 2.0 compliance and protecting CUI will feel this first, but the logic applies to any regulated industry. A fast fix with no record is hard to prove. A slow fix with a documented, risk-based rationale is at least defensible.

The Industry Is Already Behind the Curve

If attackers move in days, how fast do defenders move? The Verizon 2026 Data Breach Investigations Report offers a sobering answer. It found that vulnerability exploitation was the top initial access vector, at 31 percent of breaches, up from 20 percent in the prior edition. It also reported that only 26 percent of vulnerabilities in the CISA catalog were fully remediated, down from 38 percent, and that the median time to remediate rose to 43 days from 32.

Put those figures next to the Rapid7 numbers and the shape of the problem appears. Attackers act in about three days. Defenders, at the median, take about forty-three. Even if you treat both numbers generously, there is a gap of several weeks during which a known, exploited flaw sits open on systems that someone is already scanning for.

Be careful with this comparison, though. The two datasets measure different things with different methods. Verizon counts breaches and remediation across a broad population of organizations, while Rapid7 tracks exploitation timing for a specific set of vulnerabilities. The point is not that one number divides neatly into the other. The point is that the two curves are diverging, and nothing in either dataset suggests they will converge on their own.

Here is the uncomfortable corollary for governance teams. A median remediation time of 43 days means half of organizations are slower than that. If you do not know where you sit relative to the median, you cannot answer a board member who asks whether the company is ahead of or behind its peers. Measuring your own time to remediate, by severity and by exposure, is the starting point for every conversation that follows.

The Zero-Click Problem and Why 34 of 43 Matter Most

Of the 43 newly exploited vulnerabilities Rapid7 tracked, 34 required no authentication and no user interaction. That is 79 percent of the exploited set. Rapid7 describes this combination as the “holy grail” for attackers, and the label fits. There is no phishing email to craft, no password to steal, and no employee to fool. The attacker sends a request to a reachable service and gets in.

This finding quietly undermines a comfortable assumption. Many security programs invest heavily in awareness training, multifactor authentication, and identity controls, and those investments are valuable. But none of them stops an unauthenticated flaw in an internet-facing service. The defense for that class of vulnerability is narrow and unglamorous. You must know the asset exists, know it is reachable, know it is vulnerable, and fix or isolate it before someone else finds it.

Rapid7 also offers a cautionary note about severity labels. In its analysis, authentication bypass flaws had the highest exploitation rate of the impact types it examined, at 3 of 191, or about 1.6 percent. Remote code execution flaws were exploited at a lower rate, 18 of 2,082, or about 0.6 percent. Neither rate is large. What this shows is that most vulnerabilities are never attacked, and that exposure-aware prioritization beats chasing every high score.

Be careful not to blend this 79 percent figure with other percentages in the report. The 79 percent describes the exploited set. Rapid7 separately reports shares of all tracked CVEs that are remote, unauthenticated, or zero-click, and those are a different population. Mixing the two produces a headline that no longer matches the source, which is exactly the kind of error a skeptical board member or auditor will catch.

For leaders, the practical lesson is about where to place scarce attention. Rapid7 reports that new CVSS 7 to 10 vulnerabilities rose 133 percent year over year and that proof-of-concept availability rose 86 percent. The volume is growing faster than any team can absorb. Triage must therefore start from exposure and known exploitation, not from the score alone.

The Repackaging Economy and the Nation-State Overlap

Fast exploitation does not require brilliant attackers. It requires efficient ones. Rapid7 monitored 63 underground posts in the quarter, and 41 of them advertised remote desktop or network access. Another 14 involved exploits or zero-days, and most of those concerned known flaws already described in vendor advisories or the CISA catalog.

Read that again. The commercial exploit market is largely a repackaging business. Once a vulnerability is public and a proof of concept circulates, someone turns it into a product. The three-day average is partly a story about supply chains inside the criminal economy, where access brokers, tool developers, and ransomware affiliates each take a slice and each moves quickly.

Nation-state activity follows the same pattern. Rapid7 linked 15 distinct vulnerabilities to six tracked actors or clusters, and APT31 alone accounted for 8 of those. The report also describes a Linux toolkit attributed to North Korea-linked operators that used a trojanized build of HAProxy to target South Korean automotive and media organizations. Other tracked groups focus on NATO countries, Ukraine, and Indian government and military personnel.

Why should a commercial compliance team care about espionage groups? Because the same flaw rarely stays in one actor’s hands. Techniques that begin in a state-sponsored campaign tend to trickle into criminal tooling, and the reverse also happens. A vulnerability that appears in a government-focused intrusion today is a ransomware affiliate’s entry point tomorrow. Treating nation-state reporting as someone else’s problem leaves a blind spot in your threat model.

What the Ransomware Listings Say About Where Exposure Lands

Rapid7 counted 1,112 US ransomware leak-site listings in the quarter, roughly eight times the figure for Germany, and the United States accounted for about 60 percent of incidents globally in the report. Among groups, The Gentlemen led with 342 listings, followed by Qilin with 339 and INC Ransom with 99. Those group totals come from Rapid7’s overall ranking, so they should not be read as a US-only breakdown.

Leak-site data deserves its own caveat. Listings reflect what criminals choose to publish, and they are claims, not verified incidents. Organizations that pay quietly never appear. Even so, the pattern is useful as a directional signal, and it points to concentrated activity by a small number of aggressive groups.

The government finding stands out most. Government-sector ransomware incidents among the top 10 reporting countries rose from 48 to 55 quarter over quarter, an increase of 15 percent. The United States share of those incidents climbed from 33 percent to 45 percent. Rapid7 names Qilin, The Gentlemen, KryBit, and SafePay as the most consistent operators against government targets.

If you serve public agencies, those numbers belong in your risk register. Agencies share sensitive data with contractors, and attackers know that suppliers can be softer targets than the agencies themselves. A strong third-party risk management program asks what an attacker could reach through a compromised vendor, and a mature incident response plan rehearses that scenario. Rapid7 itself advises public-sector defenders to focus on detecting common ransomware tradecraft rather than memorizing lists of groups, because the groups change faster than the lists.

AI Is a Speed Multiplier, but Not the Main Story Yet

No threat report in 2026 can skip artificial intelligence, and Rapid7 handles it with welcome restraint. Only 8 percent of its tracked reporting cites AI as an operational component of attacks. Humans still select targets and objectives. Where AI appears, it assists with choosing techniques, triaging targets, and recovering from failed steps, and some actors split their objectives across multiple AI sessions to slip past safeguards.

Christiaan Beek, Rapid7’s VP of Intelligence, made the point bluntly. In his words, “Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn’t materialized.” He also warned that the 8 percent is “a snapshot of adoption, not a ceiling.”

That framing is worth adopting internally. AI is accelerating the discovery side of the equation, which means more disclosed vulnerabilities, more proof-of-concept code, and a shorter path from advisory to working attack. It has not yet changed who is in charge. A human attacker still decides to go after your environment. That is good news in one sense, because it means the fundamentals still work, and sobering in another, because those fundamentals have a shrinking time budget.

For governance leaders, the sensible response avoids both extremes. Do not dismiss AI as hype, and do not rewrite your whole program around it. Monitor for unexpected AI API usage from hosts that should never call such services, as Rapid7 recommends, and make sure your remediation clock is fast enough to survive a world where exploit code arrives sooner than it used to.

Expressing Risk Appetite in Days of Exposure

One line in the Rapid7 report deserves to be quoted in every board pre-read. It says, “A risk appetite you can’t express in days of exposure is just hope with a budget.” That sentence captures a real weakness in how many organizations govern vulnerability risk.

Consider how risk appetite is usually written. Policies say things like “critical vulnerabilities will be remediated promptly.” Promptly is an adjective, and adjectives cannot be audited. A defensible program replaces it with a commitment such as “exploited vulnerabilities on internet-facing systems will be remediated or isolated within seven days, with documented exceptions approved by the CISO.” Now there is something to measure, and something to be held accountable for.

Setting those numbers is a governance decision, and it works best as a collaboration. The CISO knows what is technically feasible. The chief compliance officer knows what regulators and contracts will accept. The business owner knows which outages are tolerable. Together they can set tiers, for example faster windows for exploited flaws on exposed systems and slower ones for internal systems with compensating controls. A CISO Dashboard that reports time to remediate against those tiers turns a policy into a living metric.

The harder discipline is evidence. For each tier, you need records showing when the vulnerability was disclosed, when it was detected in your environment, who decided what to do, and when the fix or compensating control took effect. Audit trail data that feeds a SIEM makes the reconstruction faster and more credible. When an assessor or a regulator comes asking, the organization that can produce a clean timeline is in a stronger position than the one reconstructing events from memory and email. As always, confirm the specific obligations that apply to you with your legal counsel.

Securing the Data Exchange Layer First

Rapid7 recommends that defenders identify externally accessible assets and prioritize those with known exploitation, unauthenticated attack paths, and support for critical business functions. Run that filter across a typical enterprise and one category rises quickly, namely the systems that exchange sensitive data with outside parties. File transfer servers, secure email gateways, and web portals for partners must be reachable from the internet to do their jobs, and they hold exactly what attackers want.

A sensible response begins with inventory and data classification, so that you know which exchange channels carry regulated content. It continues with architecture. Network segmentation limits how far an attacker can travel after landing on an exposed service, and a zero trust architecture assumes that any single control can fail. These principles apply to zero trust data protection at the content layer as well, where the question is not only who can reach a server but what they can do with each file once they arrive.

This is where consolidating exchange channels pays off. When email, file sharing, and managed file transfer run on separate products from separate vendors, each one adds its own patch cadence and its own exposed surface. Kiteworks takes a different approach by unifying those channels in one platform delivered as a hardened virtual appliance with an embedded firewall and web application firewall, least-privilege administration, and a reduced attack surface. The platform’s encryption is FIPS 140-3 validated, and every transfer generates audit evidence. Organizations that move files through a Secure MFT capability can then measure and prove exposure for one governed system instead of reconciling several.

No architecture removes the need to patch. A hardened design buys time and narrows the blast radius, which matters when the window between disclosure and exploitation is measured in days. It also simplifies the evidence story, because one audit trail is easier to hand to an assessor than five.

A Practical Playbook for the Next 30 Days

Translating all of this into action does not require a new budget cycle. It requires a few decisions and some disciplined follow-through.

Start by measuring. Pull the last quarter of remediation records and calculate the actual time from disclosure to fix for every vulnerability in the CISA catalog that touched your environment. Break it down by internet-facing versus internal systems. Most teams find the numbers are worse than the policy implies, and that discovery is more valuable than any dashboard.

Next, set tiered commitments in days. Agree on a seven-day target for exploited flaws on exposed systems, a longer window for internal assets, and an exception process that requires a named approver and an expiry date. Write the commitments in the risk appetite statement so the board can see them.

Then fix the evidence. Make sure every remediation, isolation, or accepted exception creates a record with timestamps and an owner. Confirm that your logs are retained long enough and stored where an assessor can reach them. Include your suppliers by asking for the same evidence from vendors who connect to your data, and use your supplier reviews to check it.

Finally, rehearse. Run a tabletop that starts with a new, exploited flaw in an externally reachable file transfer service and ends with a board update. Time each step. The exercise will expose where approvals stall, where inventories are stale, and where the three-day clock would have run out. If you work with public agencies, bring the government compliance team into the room, since their obligations often set the tightest expectations.

To learn more about reducing exposure across your sensitive data exchange channels, schedule a custom demo today.

“`original code template start“`

Additional Resources

• Blog Post Zero Trust Architecture: Never Trust, Always Verify
• Video Microsoft GCC High: Disadvantages Driving Defense Contractors Toward Smarter Advantages
• Blog Post How to Secure Classified Data Once DSPM Flags It
• Blog Post Building Trust in Generative AI with a Zero Trust Approach
• Video The Definitive Guide to Secure Sensitive Data Storage for IT Leaders