Skip to content

AI Glossary · Metrics

What is Time to Exploit?

Time to Exploit

Time to exploit measures when a vulnerability is first known to be exploited relative to a reference date, such as public disclosure or patch release. A negative value means exploitation happened before that reference date.

Also known as: time-to-exploit

· Updated · Chain of Thought

AI Security

  • 1 episode
  • 2 guest clips

The calculation is the exploitation date minus the chosen reference date. If a patch arrives on September 10 and exploitation began on September 8, patch-relative time to exploit is minus two days. Mandiant’s analysis of 2023 exploitation uses patch release as its reference and explains that the first reported exploitation may be later than the actual first attack.

Compare reports only after checking their reference dates, which vulnerabilities they include, and how they handle outliers. An average from observed exploited vulnerabilities does not describe every disclosed flaw or guarantee a safe patching window. In the episode below, Dan Lorenc connects compressed exploitation timelines to the need for faster remediation. Mean time to remediate measures the discovery-to-fix interval and explains why it has a different boundary. Keep that operational argument separate from any claim about a universal average or what caused it to change.

Time to exploit: how an average can go negative An illustration, not data, of Chainguard CEO Dan Lorenc's explanation in episode 68. Each dot is an exploited vulnerability placed by its exploitation date relative to disclosure, which sits at zero. Zero days fall to the left of zero, exploited before disclosure. Before: a long tail of vulnerabilities exploited months or years after disclosure sits to the right and pulls the average positive. Now: cheap models let attackers weaponize a known vulnerability quickly, so that tail is squeezed into weeks, the zero days remain, and the average shifts below zero. Below: a negative average does not mean every flaw is exploited before disclosure; check the reference date and the set of vulnerabilities a report counts. How an average time to exploit goes negative Dan Lorenc’s explanation in episode 68. Illustrative dots, not data. disclosure = 0 ← before disclosure after disclosure → BEFORE zero days long tail: exploited months or years later average: positive NOW tail squeezed into weeks average: below zero Cheap models turn a known vulnerability into an exploit fast, so fewer wait for years. A negative average is not a universal patch window. It describes the exploited vulnerabilities a report counted, measured from the reference date it chose. Check both before comparing reports.
An illustration of Dan Lorenc’s explanation from episode 68, not a plot of any report’s data. Download the image

Hear it from the guest

“But then there's a big fat tail on the other side of that balancing out the average of things that are disclosed and never exploited, or things that are disclosed and exploited years later. That's the part that's been squeezed, I think.”
Dan Lorenc, Chainguard EP 68 · around 3:58 · read the transcript
Watch on YouTube
“The only way we as an industry can … combat that whole terrifying stat around the mean time to exploit being negative is to try to get the mean time to remediate even further negative”
Dan Lorenc, Chainguard EP 68 · around 11:58 · read the transcript
Watch on YouTube

Quotes lightly edited to remove filler words.

From the conversation

Mean Time to Remediate (MTTR)FuzzingZero-DayAgent Swarm