What is time to exploit, and why do attacks now beat the patch?

Time to exploit (TTE) is the average time between the release of the patch that fixes a vulnerability and the first real attack that uses the flaw to break into a system. That is how Mandiant defines it; the incident response firm, now part of Google, calculates it only for vulnerabilities that were actually exploited, not for every one published. The sign is what matters. A positive value tells you how many days, on average, you have left to patch before the attack; a negative value means the attack arrives while no patch exists yet. Flaws hit in that window are called zero-days, and those hit afterward are n-days. According to Mandiant, TTE was 63 days in 2018-2019 and fell to five in 2023; the M-Trends 2026 report estimates minus seven days for 2025. On average, the attack now comes before the fix.

See also: Patch management · The process by which a company discovers, prioritizes, tests and installs security updates for its systems, measured in days of exposure.

Measured against what

Every TTE figure depends on when the clock starts. The report in which Mandiant introduced the name, in September 2023, framed it against the flaw's public disclosure; the next one frames it against the patch, yet reports the same historical series. VulnCheck, a company that maintains its own catalog of exploited vulnerabilities, starts instead from the publication of the CVE, the flaw's public identifier. According to its January 2026 report, 28.96% of the vulnerabilities added to its catalog in 2025 were exploited on or before the day their CVE was published; in the first half of 2026 the share was 23.43%. VulnCheck's and Mandiant's figures cannot be compared: different clocks, different samples.

What an average hides

TTE is an average and should be handled as one. The five days for 2023 exclude 15 outliers; with them included, the average rises to 47. The same report warns that its estimates are conservative, because they count the first reported exploitation, which is often vaguely dated, and because some attacks are never discovered. Of the 138 exploited vulnerabilities analyzed for 2023, 70% were hit as zero-days, and that share is what drags the average down. For the rest, the patch still helps if you move fast: 12% were exploited within a day of the fix, 29% within a week and 56% within a month.

An enterprise example

A logistics group closes already exploited flaws within seven days: a respectable window. One morning the maker of its VPN gateway, the device employees use to reach the network remotely, warns that a flaw is under attack and the patch will ship in a week. The patch schedule is no help here; what counts are the decisions made earlier. The device's management interface cannot be reached from the internet; network segmentation keeps the gateway isolated from the warehouse servers; monitoring flags unusual logins at night. The contract requires the vendor to give immediate notice of exploited flaws, along with interim mitigations. The company stays exposed for a week, but an intruder would find little within reach.

Why it matters for decision makers

A negative TTE shifts the question from "how fast is the patch applied" to "what happens if the attack comes before the patch". Patch management remains essential for flaws that already have a fix, but it is not enough. The other levers: shrinking what is exposed on the internet, the job of Attack Surface Management; segmenting, so that a compromised system can reach little else; applying compensating controls, such as disabling a feature, until a patch exists; and monitoring that spots exploitation as it happens. CISA's Binding Operational Directive 26-04, issued in June 2026 for US federal civilian agencies, follows the same logic: taking a system off the internet is a valid mitigation that pushes back the deadline for fixing it. Contracts should spell out how quickly each vendor must warn you about an exploited flaw.