The disclosure to exploit window is the time between a CVE being published and a working exploit appearing. It has been getting shorter, most of all for internet-facing remote access products. Some exploitation begins before a patch exists. Defenders therefore need warning before a patch is ready, not after it ships.
For most of the last decade, the time between disclosure and exploitation ran slowly. A new CVE would be published. Security teams would have weeks to assess and patch. Exploitation, when it came, arrived after most organizations had already closed the gap. That assumption no longer holds.
The time between vulnerability disclosure and a working exploit has collapsed for many vulnerabilities. This is most true for internet-exposed remote access infrastructure.
This is not a single trend. It is the convergence of three forces:
- Record vulnerability volume that overwhelms manual triage.
- Automated scanning infrastructure that tests every newly disclosed CVE within hours of publication.
- Artificial intelligence that is cutting the time needed to go from a CVE description to a working exploit.
Understanding why this window closed, and what is driving it, is the foundation for deciding how a vulnerability management program needs to change. For worked examples, see the vulnerability profiles in the Knowledge Hub.
| 263% increase in CVE submissions between 2020 and 2025 (NIST) |
How Fast Is the Disclosure to Exploit Window Collapsing?
The shift from weeks to days to hours did not happen in a single jump. It has been a steady compression. Better attacker tooling drove it. So did improvements in the infrastructure that spreads vulnerability information itself.
From Weeks to Days
Historically, the gap between a vulnerability being discovered and exploited in the wild was measured in months. With automated scanning and AI-assisted research, defenders now often have much less time between disclosure and first exploitation. Zero-day exploitation, by definition, comes before any patch exists.
Shortest Windows for the Highest-Risk Categories
For specific technology categories, the window is shorter still. It is shortest for internet-exposed remote access infrastructure:
- VPN concentrators
- Remote desktop gateways
- Firewalls with management interfaces reachable from the public internet
These are weaponized faster than almost any other category. Successful exploitation hands the attacker an interactive foothold inside the network immediately.
| ๐ก Why the Window Is So Short Automated exploit scanners are now configured to test against the National Vulnerability Database feed directly. The moment a new CVE for a known product category appears, scanning infrastructure that has been pre-built and pre-staged begins testing internet-facing instances of that product within the same business day. This is not artisanal exploit development; it is industrial automation applied to a published feed. The CVE publication event itself has become the trigger for an automated attack pipeline. |
The Volume Backdrop
This acceleration is occurring against a backdrop of record vulnerability volume. That volume makes manual response increasingly untenable. CVE submissions increased 263 percent between 2020 and 2025, according to NIST. NIST responded to this volume pressure in April 2026. It began prioritizing NVD enrichment for CVEs in the CISA KEV catalog, software used within the federal government, and critical software as defined by Executive Order 14028.
Why Did the Patch Window Close? Three Converging Forces
The compression of the disclosure-to-exploit window is not the result of any single factor. It is the product of three trends that reinforce each other at the same time.
1. Patch Development Has Not Kept Pace
The structural asymmetry at the center of this problem is simple. Exploitation speed has accelerated dramatically. Vendor patch development and distribution timelines have not sped up at anything close to the same rate. A vendor that takes two to four weeks to develop, test, and release a patch is working to a timeline set for a threat landscape that no longer exists. The gap between exploitation speed and remediation speed is not closing. It is widening, and that widening gap is precisely where successful attacks occur.
2. Automated Scanning Has Industrialized Opportunistic Exploitation
Mass exploitation campaigns no longer require an attacker to find and target vulnerable systems by hand. Automated scanners, often built and run as commercial or semi-commercial infrastructure, monitor the NVD feed and security advisories directly. They then launch testing against internet-facing instances of newly disclosed vulnerable products within the same business day the CVE appears. This turns every new disclosure into an immediate, automated, internet-wide test of every reachable instance of the affected product.
3. AI Is Compressing Both Discovery and Weaponization
The third and most consequential force is the use of AI in vulnerability research and exploit development on both sides. AI capabilities can speed up vulnerability discovery, weaponization and exploit deployment. This creates the potential for exploitation to move faster than ever before. This is the focus of the next section.
The Role of AI: Amplifying Attackers Without Replacing Them
AI’s effect on the exploitation timeline is real. It is also an amplifier of human-directed operations rather than a fully autonomous threat. That distinction matters enormously for how defenders should respond.
A Network Device Zero-Day: CVE-2025-21590
CVE-2025-21590 is an improper isolation flaw in the Junos OS kernel on Juniper Networks devices. NVD records it as published on March 12, 2025. CISA added it to the Known Exploited Vulnerabilities catalog the next day.
- CVE ID
- CVE-2025-21590
- Product
- Junos OS kernel
- Weakness
- Improper isolation or compartmentalization (CWE-653)
- Published
- March 12, 2025
- Added to CISA KEV
- March 13, 2025
- CVSS 3.1 base score
- 4.4 (medium), per NVD
The Dual-Use Reality: AI Defends Too
The same capability accelerating offensive exploit development is also accelerating defensive vulnerability discovery. The same models can continuously scan complex environments. They can identify misconfigurations and zero-days at scale. They can generate patches or compensating controls at machine speed. In the hands of a determined attacker, they can also collapse the cost and expertise needed to find and exploit critical flaws.
Why Is Proactive Threat Intelligence No Longer Optional?
A vulnerability management program built around periodic scanning, scheduled monthly patch cycles, and a manual review queue was a reasonable design when the average exploitation window was measured in weeks. The window is now measured in hours for the highest-risk categories. Against that, the design cannot protect during the period that matters most: the gap between disclosure and patch deployment.
The Case for Compensating Controls Activated Before Patching Completes
Say a patch cannot be deployed within hours of disclosure. For the vast majority of enterprise environments, it cannot. Then the only viable defense during the exposure window is a compensating control that does not depend on the patch:
- Network segmentation that limits the blast radius of a compromised device.
- Default-deny policies on management interfaces.
- Behavioral detection tuned to the specific exploitation pattern associated with the vulnerability class.
- Most importantly, advance knowledge that a specific CVE affecting your specific technology stack has entered active exploitation.
Why Reactive KEV Monitoring Is Not Enough
CISA describes the KEV catalog as a list of vulnerabilities already exploited in the wild, to be used as an input to prioritization. That makes it a confirmation mechanism, not an early-warning system. Organizations whose vulnerability intelligence stops at KEV monitoring learn about exploitation only after it has been confirmed.
What Proactive CTI Actually Changes
Proactive threat intelligence shifts the detection point from the patch deployment stage to the exploitation preparation stage. Dark web forums and exploit marketplaces often carry discussion of working exploits, proof-of-concept code, and active targeting campaigns. This happens before that activity shows up in any public vulnerability database. Monitoring this layer gives a detection window that exists before automated mass-scanning campaigns reach your specific assets, not after.
Operational Implications: What This Means for Your Program
| What the Data Shows | What Your Program Needs to Do |
| The time between disclosure and exploitation keeps shrinking, and is shortest for internet-facing edge devices | Monthly or even weekly patch cycles cannot close the exposure window for high-risk technology categories. Compensating controls must be pre-staged, not deployed reactively after disclosure. |
| Some exploitation begins before a CVE is public | Patch-gap analysis alone cannot protect against this category. Behavioral detection and network segmentation must cover the period before a CVE identifier even exists. |
| CISA KEV lists vulnerabilities already confirmed as exploited | KEV monitoring alone is a lagging signal. Dark web and exploit marketplace monitoring is required to detect exploitation activity before public catalog confirmation. |
| CVE submissions up 263% between 2020 and 2025 are overwhelming manual triage and NVD enrichment capacity | Exploitation-signal-based prioritization, not CVSS score alone, must drive patch sequencing. EPSS scores and real exploitation telemetry are now necessary inputs. |
| RELATED READING: The 2026 Vulnerability Exploitation Trends: What Threat Actors Are Actually Using brandefense.io/blog/2026-vulnerability-exploitation-trends-h1-analysis. Our H1 2026 analysis of CVE volume, exploited-in-the-wild statistics, n-day versus zero-day ratios, and sector-level exploitation distribution. |
How Brandefense Closes the Disclosure-to-Exploit Gap
Working well against a window measured in hours requires intelligence that moves at the same speed as the exploitation activity it is meant to detect. Brandefense’s EASM and CTI platform is built specifically to close the gap between public disclosure and the moment your organization needs to know it is exposed.
| Brandefense Capability | Application to the Collapsing Exploit Window |
| Continuous External Attack Surface Monitoring | Maps every internet-facing asset in real time, so the moment a CVE is published for a product you run, you already know which specific assets are affected without waiting for a manual inventory check |
| Pre-KEV Exploitation Intelligence | Dark web and exploit marketplace monitoring detects working exploits, proof-of-concept releases, and active targeting discussion before they are reflected in the CISA KEV catalog, closing the visibility gap left by confirmation-based catalogs |
| AI-Accelerated Threat Actor Tracking | Monitors state-sponsored and criminal use of AI-assisted exploit development by actor and technology category, surfacing newly published attack frameworks and tooling relevant to your stack before they reach mass-exploitation scale |
| Exploitation-Signal Prioritization Support | Provides real exploitation telemetry to supplement CVSS scoring, enabling prioritization based on what is actually being exploited against your specific technology footprint rather than theoretical severity alone |
| 24/7 Analyst Escalation | AI does the work and analysts verify critical findings, with immediate escalation when a vulnerability in your environment enters active exploitation |
The hourglass Preminger describes is not going to slow back down. Patch development timelines are constrained by real engineering and testing requirements that cannot be compressed indefinitely. Exploitation speed has no equivalent floor and continues to fall as AI tooling matures.
The organizations that maintain protection in this environment are not the ones with the fastest patch cycles. They are the ones with the earliest signal. They know that a specific vulnerability in their specific environment has entered active exploitation, before the patch is ready and before the automated scanners arrive.
