INTEL-30: The Pre-Disclosure Window

Wed, 15 Jul 2026 00:00:00 +0000

The INTEL

Nearly three in ten actively-exploited vulnerabilities in 2025 were being weaponized on or before the day they were disclosed. For those, “patch faster” was never an option — exploitation arrived before the fix existed. Stop planning your vulnerability program around a reaction window that, for the vulnerabilities that matter most, no longer exists.

VulnCheck’s 2026 Exploit Intelligence Report puts a hard number on the fear defenders couldn’t previously quantify: 28.96% of the vulnerabilities added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in 2025 were exploited on or before the day their CVE was published — up from 23.6% the year before. The 2026 Verizon DBIR, working from a completely separate dataset, put the same figure at 29%. Two independent sources, the same fraction — which is exactly the kind of agreement worth trusting.

E91 - The Window Closed

Tue, 14 Jul 2026 00:00:00 +0000

One report is a claim. Three is a pattern.

Any single vendor threat report is easy to discount. The company publishing it sells the cure for the disease it diagnoses, and it has every reason to make the disease sound terminal. We read them anyway — carefully, and against each other — because when reports that share nothing but a publication quarter start telling the same story from opposite ends of the industry, the story stops being marketing and starts being signal.

Exploit Intelligence on FIR Risk Advisory | Risk Intelligence. Engineered.

INTEL-30: The Pre-Disclosure Window

The INTEL

E91 - The Window Closed

One report is a claim. Three is a pattern.