Qualys Study Finds Persistent Remediation Delays Across 1 Billion CISA KEV Records
Summary
Qualys says its analysis of more than 1 billion CISA KEV remediation records across 10,000 organizations found persistent patching delays despite increased ticket closures, and argues for measuring cumulative exposure and automating risk operations.
Key points
- Qualys’s Threat Research Unit says it analyzed more than 1 billion CISA KEV remediation records from 10,000 organizations over four years.
- The study reports that critical vulnerabilities still open after seven days rose from 56% to 63%, despite organizations closing 6.5 times more vulnerability events.
- Among 52 tracked weaponized vulnerabilities with complete timelines, 88% were remediated more slowly than they were exploited; the article says half were weaponized before a patch existed.
- The study gives average remediation times of 266 days for Spring4Shell and 263 days for the Cisco IOS XE flaw.
- It proposes Risk Mass—vulnerable assets multiplied by days exposed—and Average Window of Exposure (AWE) to capture cumulative exposure and long remediation tails.
- For Follina, the article reports an 85-day AWE, with pre-disclosure exposure and the long patching tail accounting for 80% of that window.
- Qualys recommends moving from manual scan-and-ticket workflows toward automated risk operations, including validating exploitability in specific environments.
Article Details
- Publisher
- BleepingComputer; sponsored and written by Qualys
- Report Period
- Four-year analysis; published 2026-04-10
- Scope
- Qualys analysis of CISA KEV remediation records and remediation timelines across organizations.
- Sample Size
- More than 1 billion remediation records from 10,000 organizations; 52 high-profile weaponized vulnerabilities with complete exploitation timelines.
- Key Statistics
- Critical vulnerabilities still open at Day 7 increased from 56% to 63%.
- Of 52 tracked weaponized vulnerabilities, 88% were remediated more slowly than they were exploited.
- Of 48,172 vulnerabilities disclosed in 2025, 357 were remotely exploitable and actively weaponized.
- For Spring4Shell, exploitation occurred two days before disclosure, while average enterprise remediation took 266 days.
- Recommendations
- Implement autonomous, closed-loop risk operations to reduce remediation latency.
- Use cumulative exposure measures such as Risk Mass and Average Window of Exposure alongside CVE counts.
- Validate whether vulnerabilities are exploitable in the specific environment before prioritizing response.
- Shift practitioners from manual execution toward governing policies for autonomous systems.