Qualys: More Vulnerability Remediation Is Not Closing the Exposure Gap

Summary

Qualys research found that vulnerability closures rose sixfold from 2022 to 2025, while the share of critical findings still open after seven days increased. The article argues for prioritizing vulnerabilities using exploitation evidence and asset context.

Key points

• Qualys reports that closures rose from 73 million in 2022 to 473 million in 2025, while critical findings still open at day seven increased from 56% to 63%.
• The article says less than 1% of vulnerabilities are actively exploited, and argues that volume- and CVSS-led remediation can misdirect effort.
• For the most critical actively exploited vulnerabilities over four years, manual remediation reportedly failed to keep pace with attackers 88% of the time; half were weaponized before a patch existed.
• Qualys reports that 15% of organizations using an operationalized remediation pipeline patched before a vulnerability was added to the CISA KEV list.
• The article recommends prioritizing with exploitation evidence, asset context and business impact, and automating remediation decisions before tickets enter the backlog.
• It reports mean time to exploitation at about −7 days versus about +30 days to remediate.