The exploitation window

Method & limits

Sources: the CISA Known Exploited Vulnerabilities catalogue for exploitation dates, and NVD API 2.0 for CVE publication dates. Rebuilt nightly and committed to git, so every figure on this page has a dated, diffable snapshot behind it. Days-to-KEV is dateAdded − published in UTC calendar days.

Storage threshold for v1: a per-CVE record is kept only if the CVE has CISA KEV membership. Everything else exists as a monthly count per vendor and nothing more. Future versions plan to add CVSS >= 9.0 and EPSS >= 0.10 clauses, but neither is currently computed or evaluated, so the threshold is presently KEV membership alone.

KEV records exploitation CISA has confirmed, so it is a floor and not a census — real exploitation is higher. Disclosure counts measure disclosure, not security: a vendor with more CVEs may simply be looked at harder. Vendor attribution follows KEV's own vendor field with known synonyms merged, and is imperfect. The KEV ratio's denominator starts at 2021-01, so its numerator counts only KEV entries published in that window — which is why a vendor's KEV column and its ratio do not divide into each other.

CVEs added to KEV before NVD published them give a negative days-to-KEV. The record keeps the real number; every median clamps it to zero, because a defender's answer to “how long did you have” cannot be less than none. The “edge devices” cohort is derived, not hand-picked: each KEV entry's product name is classified as enterprise perimeter kit — VPN, firewall, gateway or WAN-edge appliance — and a vendor is tagged edge only when a strict majority of its own KEV entries clear that bar (with at least three entries, so one record can't decide it). The dashed lead-in on the chart marks months whose 12-month window reaches back past the start of the KEV catalogue.

Two limits worth stating plainly, because they both push in the same direction as the headline claim and a reader is right to ask about them. First: dateAdded is when CISA catalogued a CVE as exploited, not when exploitation actually began. CISA has gotten faster at adding entries since 2021, so some of the narrowing this page shows is CISA's own process speeding up, not attackers moving faster — the two are conflated here and a future data batch will try to measure the process-speed effect on its own, so it can be separated out rather than assumed away. Second: NVD's publication date is not the disclosure date either. Vendor security advisories often land days to weeks before NVD publishes its own record, and NVD's publication backlog — particularly bad through 2024 and 2025 — pushes some publication dates later still. So every “days since publication” figure on this page understates real exposure time, by an amount that varies CVE to CVE and can't be corrected for with the data in hand. A future data batch will add CNA-sourced publication dates, which route around the NVD backlog, as a more accurate alternative.

The rolling chart's most recent months are biased fast for a third, related reason: a CVE published recently that will eventually take years to reach KEV has, by definition, not been added yet — so the newest window is populated only by the fast movers, because the slow ones haven't had time to show up. A plain trailing median therefore reads the recent end of the line as faster than it will turn out to have been. The correction is to only count a CVE once it has had time to mature: exclude anything published fewer than 365 days before the point being measured, so the recent window is judging the same kind of population as the older ones rather than a survivorship-biased slice of it.