In M-Trends 2026, Mandiant’s analysts estimated that attackers now exploit vulnerabilities an average of about seven days before the vendor ships a patch.
That’s a scary number, so reporters and security vendors have both found it worthwhile to repeat that number in headlines for months. I understand the appeal: If it’s true, defenders now start every patch cycle already behind, and a smart security leader would move budget from patching to detection based on the idea that breaches are inevitable.
I consider myself a skeptic about numbers like these, so my team counted the same kind of attacks a different way. As happens so frequently when we track down these numbers, we found a very different answer.
We started by collecting every CVE that security researchers confirmed had been exploited in the wild between January 2018 and mid-July 2026, for a total of 3,769. For 81.1% of these known exploited vulns, the vendor had already shipped a patch by the day attackers first struck.
That already seems a bit different than “an average of seven days before the patch.” We dug deeper, researching how long after the patch attackers typically exploited a CVE.
For the CVEs attackers first exploited in 2026, they waited a median of 116 days. This means that for half the n-days attackers exploited this year, defenders had the patch in hand for nearly four months or longer.
Which of these numbers is right? Security leaders who believe Mandiant’s number will probably patch vulnerabilities and assign funding and attention very differently from those who believe ours. So let’s look at why the numbers ended up different, so you can make up your own mind about who to believe.
How each of us timed the same attackers
I covered the fight over the word “zero-day” in Zero-Day Is Not What You Think, so let’s stay on the math here.
ZeroDayClock and VulnCheck start the clock for vulnerability timing when the National Vulnerability Database (NVD) publishes their CVE records. NIST runs NVD, and in recent months, its catalogers published vulnerability information an average of roughly 25 days after vendors shipped patches.
What that means is that anyone who times CVEs “from publication” will give undue credit to attackers for their incredible speed, scoring an attacker who struck three days after the patch as 22 days before publication. VulnCheck’s own research team acknowledged the problem in their report, noting that attackers hit some vulns on or before CVE day that actually weren’t zero-days.
Mandiant’s analysts don’t fall into this same trap. They start counting at the same point we do: at the patch. Mandiant describes “time-to-exploit” as the average time attackers take to exploit a vulnerability, before or after the vendor releases a fix. So how did they get a negative number based on the attacks they looked at?
It all goes back to the difference between the mean and the median.
In their 2023 study, Mandiant looked into 138 exploited vulnerabilities, classifying 70% as zero-days, and using the mean time to exploit. Here’s where the math gets funky: an attacker who exploits a zero-day strikes in the “negative days” before any patch exists. If the number of “negative days” is high for even a small number of vulnerabilities, it skews the average. An analyst can end up with a mean below zero even when most n-day attackers waited months.
Because it can throw the math off, we count exploited zero-days separately and we found 711 of them since 2018. For n-days, we report the median, because we don’t want a few extreme cases dragging our number around.
And there’s another way we know our math (and everyone else’s) is never quite right: catalogers can’t confirm some attacks until months or years after they happen, which means our counts for recent months/years will always be “off” (and will always be an underestimate, because the long tail keeps getting longer).
Imagine standing at the finish line two hours into a marathon. Eight runners have crossed, all under 2:15, and if you average their times you’ll conclude a typical marathon takes about two hours and twelve minutes. But thousands of runners are still on the course, and they’ll pull your average up all afternoon. When we measure this year’s attacks, the same principle drags the average time down.
Attackers waited months after the patch
Counting from the patch and using median instead of mean, we found that attackers waited a median of 24 days in 2018. They peaked in 2023 at a whopping 327 days, followed by a more normal 112 days in 2024, and 116 days so far in 2026.
Every year since 2021, they’ve waited more than 100 days. The forecasts I’ve read for two years say attackers should be striking faster by now. Measured from the patch, they wait almost five times as long as they did in 2018.
Defenders got months of warning and still lost
In spite of the lag time, n-days still wreak havoc on businesses. Verizon’s researchers found that attackers initiated breaches by exploiting vulnerabilities in 31% of breaches from this year’s DBIR, more than any other way in.
Verizon also tracked how organizations fixed the flaws on CISA’s Known Exploited Vulnerabilities (KEV) list, the federal catalog of vulnerabilities CISA has confirmed attackers exploiting. Organizations fully fixed just 26% of KEVs in 2025, down from 38% a year earlier, and took a median 43 days from detection to a complete fix.
We can add a number Verizon’s researchers didn’t report: attackers struck 30.4% of 2026’s n-days more than a year after the vendor shipped the patch. Those victims had the patch for a year, and I’d bet their teams spent that year patching CVEs attackers never touched.
CISA’s analysts saw the same pattern in their review of 2024-2025. They found that most attacks came from opportunistic criminals scanning the internet for exposed vulnerabilities, far more than coordinated groups using zero-day CVEs to initiate exploits. Loose patch schedules mean that a criminal scanning for known flaws can afford to wait: defenders are likely to leave the targets online month after month, unpatched and vulnerable.
All this means that patching can make your organization go from a juicy target to an impenetrable fortress for most of these attackers. If well-run teams close their critical holes in the first month, attackers go hunting for an easier target with less-stringent patching.
Attackers split into a fast crowd and a patient crowd
Inside that 116-day median, we noticed a bimodal distribution implying that the bad guys split into two diverging groups. They struck 33.5% of 2026’s n-days within 30 days of patch availability … but waited over a year to exploit another 30.4%.
What’s more, they divided up along predictable lines based on vendor and flaw class (and not at all based on CVSS score, for anyone wondering).
Across the full dataset, attackers hit Google flaws within 30 days of the patch 67% of the time and Adobe 51% of the time. They hit Oracle within 30 days 18% of the time, D-Link 8%, and Totolink 4%. Attackers moved at different speeds by flaw class, too: in 2023 they hit Missing Authorization flaws within 30 days 54% of the time, but SQL injection flaws just 17% of the time.
Attackers also keep coming back to the same places. They exploited more Microsoft n-days than any other vendor’s in each of the last nine years, returned to roughly the same 15 vendors year after year, and have favored command injection, path traversal, and SQL injection since 2018.
This means a data-driven patch program should be built around a short deadline for the fast crowd’s favorite vendors and flaw classes, plus someone who works on finding the forgotten servers and appliances that are evading scanning (which the patient crowd will hunt).
Google’s analysts say attackers are speeding up
Our data set that we’ve done this analysis on ended on July 15, 2026. Two teams have published since then: have their numbers changed the case? I tend to think not.
In September, Google’s Threat Intelligence Group (GTIG) counted 5,045 CVEs monthly in January and more than 10,000 by July and August. Google’s analysts showed that attackers drove 2026’s rise in attacks mainly by quickly weaponizing high-risk flaws, with new zero-days playing a smaller part. Attackers used 11 zero-days a month, up from eight in 2025, an increase GTIG itself called marginal.
VulnCheck’s State of Exploitation Report for H1-2026 found the median time from CVE publication to a KEV listing falling from 120 days in 2025 to 80 days in the first half of 2026. Their researchers also found attackers striking a smaller share of KEVs on or before CVE day, 23.43%, down from nearly 29% in 2025, and exploiting roughly 200 CVEs within a month of publication, a steady rate. Of the 1,061 vulnerabilities researchers attributed to AI-assisted discovery, attackers had exploited 14.
I take the GTIG numbers seriously. If attackers do start weaponizing n-days faster, the fast crowd grows, and a team facing 10,000 new CVEs a month will need to choose its patches even more carefully than it does now.
I’d wait before reading VulnCheck’s 80 days as a trend, though. Their researchers could count only the attacks catalogers had confirmed by midyear, and (remember the marathon we talked about a few minutes ago?) catalogers confirm fast attacks first, so I expect this median to climb over time as some of the stragglers get logged.
Spend the months on the CVEs attackers use
I don’t blame anyone who took “negative seven days” seriously. A security leader who believed it would have good reason to stop trusting their patch program and move a lot of funds to detection and response.
But Google’s own threat intelligence analysts read their acceleration data and still told organizations to replace unprioritized mass patching with triage driven by threat intelligence. I agree with them, and I’d add what we found when we counted from the patch: defenders usually have more than a month, and often far longer, to do that triage well.
Spend that time on the CVEs attackers use.