The Numbers That Redefine Vulnerability Management
Mandiant’s M-Trends 2026 report is the most authoritative annual snapshot of enterprise threat intelligence — built from Google Threat Intelligence Group’s investigation work across more than 500,000 hours of incident response conducted throughout 2025. Its findings on vulnerability exploitation timelines should force a fundamental rethink of how security teams prioritize patch operations.
The headline statistic: 28.3% of all disclosed CVEs (Common Vulnerabilities and Exposures) are now exploited within 24 hours of public disclosure. Five years ago, the mean time-to-exploit a vulnerability was over 700 days — attackers had months to develop exploits and defenders had months to patch. By 2025, that figure had collapsed to 44 days as a mean. But the mean obscures the operational reality: more than a quarter of vulnerabilities are weaponized the same day they are announced.
The mean time-to-exploit (MTE) has not just shrunk — it has gone negative. Mandiant’s data shows an average MTE of 63 days in 2018, declining to -1 day by 2024, and reaching -7 days in 2025. This means that for a significant category of high-value targets, attackers are exploiting vulnerabilities before patches are publicly available. The term “zero-day” has expanded from a curiosity to a category that encompasses a meaningful fraction of total exploitation activity.
For enterprise security teams, this changes the question from “how quickly can we patch after disclosure?” to “what is our security posture for the period between vulnerability existence and patch availability?” That is a fundamentally different operational problem.
What 500,000 Hours of Incident Response Reveals
Beyond the exploitation timeline, the M-Trends 2026 report surfaces several findings that challenge common assumptions about how attacks unfold.
Exploits remain the leading initial access vector for the sixth consecutive year — accounting for 32% of all intrusions investigated by Mandiant in 2025. Voice phishing (vishing) has become the second most common vector at 11%, a sharp increase that reflects the effectiveness of social engineering at scale. Traditional email phishing has declined dramatically, suggesting that enterprise email security has improved while attackers have adapted to less defended channels.
The speed of attack operations has become alarming. In 2022, the median time between initial access and handoff to a secondary threat group (a practice where initial access brokers sell footholds to operators) was over 8 hours. By 2025, that window had collapsed to 22 seconds. This means detection-and-response playbooks designed to interrupt the attack chain between initial access and lateral movement need to operate at machine speed — human analysts cannot triage and escalate a handoff in 22 seconds.
Dwell times — the period between initial compromise and detection — tell a mixed story. The global median dwell time in 2025 was 14 days (up from 11 days in 2024). Internally detected incidents averaged approximately 9 days. Externally notified incidents averaged 25 days — double the 2024 figure. This divergence suggests that security teams are getting faster at internal detection while external notification (typically from law enforcement or threat intelligence services) is triggering for increasingly sophisticated, longer-duration intrusions.
The scale of the threat landscape is also expanding: Mandiant tracked 714 new malware families in 2025, bringing the known total above 6,000. Ransomware accounted for 13% of investigations — consistent with prior years but no longer growing as a share of incidents, as espionage and data theft operations have grown faster.
Advertisement
What Enterprise Security Teams Must Change
The patch gap crisis demands structural changes to vulnerability management programs — not just faster patching, but a different organizational logic for how vulnerabilities are prioritized, monitored, and responded to.
1. Shift from Calendar-Based Patching to Exploitation-Intelligence-Driven Prioritization
The traditional model of monthly patch cycles — even accelerated “Patch Tuesday plus N days” models — assumes that security teams have time between disclosure and exploitation to evaluate and test patches before deployment. The M-Trends 2026 data shows this assumption fails for at least 28.3% of CVEs. Security teams need real-time feeds of exploitation intelligence — specifically, which CVEs have confirmed in-the-wild exploitation — and a separate, accelerated patch SLA for that category. CISA’s Known Exploited Vulnerabilities (KEV) catalog is the baseline resource for this prioritization; supplementing it with commercial threat intelligence feeds for 0-day activity provides earlier signal. The operational goal is not to patch everything faster — it is to patch the right things before attackers deploy them at scale.
2. Implement Pre-Patch Compensating Controls for the Exploitation Window
For the category of vulnerabilities where a patch is not yet available — which M-Trends 2026 shows is a significant and growing proportion — security teams need pre-defined compensating control playbooks. These are temporary mitigation measures that reduce exploitability without requiring a patch: network segmentation to limit blast radius if a vulnerable system is compromised, application-layer controls that block the specific attack path (not all vulnerabilities require full system access — many exploit specific features that can be disabled), enhanced logging on vulnerable systems to accelerate detection, and aggressive WAF rule deployment for web-application vulnerabilities. The alternative — waiting for a patch while maintaining normal operations — is a documented organizational risk that is now quantified by Mandiant.
3. Redesign Detection and Response for 22-Second Handoff Windows
If the median time between initial access and threat actor handoff is 22 seconds, detection playbooks that rely on human analysts reviewing alerts have failed before anyone has opened the ticket. Detection logic must be engineered to trigger automated containment actions — network quarantine of compromised hosts, revocation of suspicious access tokens, forced MFA re-authentication challenges — within seconds of detection. This is the operational definition of a security operations model that keeps pace with the M-Trends 2026 threat landscape. Organizations running 4-hour MTTD (Mean Time to Detect) + 2-hour MTTR (Mean Time to Respond) operations are working in a fundamentally different threat environment than the one Mandiant documented in 2025.
The Structural Lesson: Patch-and-Wait Is No Longer a Risk Management Strategy
The M-Trends 2026 findings are not evidence of a temporary spike in attacker sophistication — they represent the equilibrium state of an ecosystem where AI-assisted exploit development, automated vulnerability scanning, and organized initial access broker markets have compressed every phase of the attack timeline simultaneously.
The historical logic of vulnerability management — disclose the vulnerability, release the patch, wait for enterprises to deploy — was designed for a threat environment where attackers had months to develop weaponized exploits and enterprises had months to respond. That environment no longer exists for a meaningful proportion of vulnerabilities. What exists instead is a race where 28.3% of disclosed CVEs are already weaponized before most enterprises have finished reading the advisory.
The structural response requires treating patch operations not as a maintenance function but as an emergency response function with tiered SLAs driven by exploitation intelligence. It requires pre-patch compensating controls as a standing operational capability rather than an improvised response. And it requires detection systems that operate at machine speed for the initial stages of attack chains.
None of these changes are technically exotic — they are organizational decisions about prioritization, tooling investment, and process design. The M-Trends 2026 data provides the threat-based justification. What happens next is a choice about how security programs are resourced and structured.
Frequently Asked Questions
What does “negative mean time-to-exploit” mean in practice?
A negative mean time-to-exploit (MTE) means that exploitation of a vulnerability begins, on average, before a public patch is available. Mandiant measured an average MTE of -7 days in 2025 — meaning attackers are actively exploiting vulnerabilities for 7 days before the vendor releases a fix. This is possible because sophisticated threat actors reverse-engineer security bulletins (which often preview vulnerabilities before patch release), monitor vendor communications for signs of impending patches, and in some cases have independent discovery of the vulnerability before the vendor does. For enterprise defenders, negative MTE means that the patch-release-then-deploy cycle cannot guarantee protection — compensating controls must bridge the pre-patch window.
How does Mandiant identify the leading initial access vectors in M-Trends?
Mandiant’s initial access vector data is derived from analyzing more than 500,000 hours of incident response investigations conducted by the Google Threat Intelligence Group in 2025. Each investigation documents how attackers initially gained access to victim environments — through analysis of logs, forensic artifacts, and threat actor tooling. The percentages represent the proportion of investigated intrusions attributable to each vector. Exploits at 32% and voice phishing at 11% reflect the actual investigated case distribution, not survey responses or threat actor self-reporting.
Which specific CVEs did Mandiant flag as most widely exploited in 2025?
The M-Trends 2026 report highlights three CVEs as particularly significant: CVE-2025-31324 (a zero-day file upload flaw in SAP NetWeaver), CVE-2025-61882 (unauthenticated remote code execution in Oracle E-Business Suite), and CVE-2025-53770 (a deserialization vulnerability in Microsoft SharePoint). SAP NetWeaver was notably targeted because it is widely deployed in enterprise ERP environments — including by large enterprises and government institutions in the MENA region. Organizations running any of these platforms should verify that patches are applied and conduct a threat hunt for indicators of compromise.
Sources & Further Reading
- Mandiant M-Trends 2026: Attackers Hand Off Access in 22 Seconds — Help Net Security
- M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds — SecurityWeek
- 2026: The Year of AI-Assisted Attacks — The Hacker News
- Ransomware Reaches Elevated New Normal in 2026 — Industrial Cyber
- Vulnerability Statistics 2026: CVE, KEV, Time to Exploit — Stingrai
- M-Trends 2026: What 450,000 Hours of Incident Response Tells Us — Resilient Cyber
