Zero-Day Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen (Cybersecurity & Privacy) | Last updated: August 10, 2026 | License: CC BY 4.0
Ninety vulnerabilities were exploited in the wild before a patch existed during 2025 — the second-highest count Google Threat Intelligence Group has ever recorded, and the fourth consecutive year inside a 60–100 band. What changed underneath that flat number is the target: almost half of those flaws sat in enterprise software and appliances, an all-time high.
Quick Answer
Google Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in the wild in 2025, up 15.4% from 78 in 2024 and 10% below the 2023 record of 100. Enterprise technologies accounted for 43 of them (48%). Axis Intelligence Research scores the resulting defender pressure at ZDPI 86.7 out of 100 for 2025 — the baseline reading of our Zero-Day Pressure Index.
Key Findings
- Google Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in the wild in 2025, compared with 78 in 2024 and 100 in 2023.
- Enterprise software and appliances accounted for 43 of the 90 zero-days exploited in 2025 (48%), an all-time high, according to Google Threat Intelligence Group.
- Axis Intelligence Research finds that 21 of the 90 zero-days exploited in 2025 — 23.3%, or roughly one in four — were flaws in security and networking products.
- Axis Intelligence Research estimates the Exploitation Visibility Coefficient at 22.9% for 2025, meaning the public federal catalog surfaced under a quarter of newly exploited vulnerabilities, vendors and products.
- Mandiant’s M-Trends 2026 report puts the mean time to exploit at an estimated −7 days, meaning exploitation now routinely precedes the patch.
How Many Zero-Day Vulnerabilities Were Exploited in 2025?
The count is 90. Google Threat Intelligence Group’s 2025 zero-day review, published March 5, 2026, defines a zero-day as a vulnerability maliciously exploited in the wild before a patch was publicly available, with a data cutoff of December 31, 2025.
That definition matters more than it looks. It excludes the far larger population of flaws exploited after disclosure, which is why zero-day counts sit in the dozens while known-exploited-vulnerability counts sit in the hundreds. Two numbers, two questions, and they get conflated constantly.
Zero-Day Exploitation by Year
| Year | Zero-days tracked | Change vs. prior year | Source |
|---|---|---|---|
| 2022 | 63 | — | Google Threat Intelligence Group |
| 2023 | 100 | +58.7% | Google Threat Intelligence Group |
| 2024 | 78 | −22.0% | Google Threat Intelligence Group |
| 2025 | 90 | +15.4% | Google Threat Intelligence Group |
Year-over-year percentages calculated by Axis Intelligence Research from GTIG counts. Four-year mean: 82.75.
GTIG’s own reading is stabilization, not escalation — the annual total has fluctuated within a 60–100 range while remaining elevated against pre-2021 levels.
Marcus Chen: The volume line is the least interesting line on the chart, and it is the one everybody quotes. Ninety versus seventy-eight tells you almost nothing about your exposure. What tells you something is that the composition flipped: the products being broken into are increasingly the ones sold to prevent break-ins. A count that holds steady while the target set moves from browsers to firewalls is not a stable threat — it is a relocated one.
Why the Detected Count Understates Reality
GTIG states plainly that its analysis reflects detected and disclosed zero-days and may not capture all exploitation. The gap is structural rather than accidental: edge devices largely lack endpoint detection and response tooling, so 14 zero-days affecting edge devices in 2025 is described by GTIG itself as likely underrepresenting true activity.
The Axis Zero-Day Pressure Index (ZDPI): How Much Pressure Are Defenders Under?
Counting zero-days answers one question. Security teams ask a different one — how hard is this year compared with what the environment could throw at us? The Zero-Day Pressure Index (ZDPI) is Axis Intelligence Research’s composite answer, on a 0–100 scale, built entirely from sourced inputs.
ZDPI Components, Weights and 2025 Reading
| Component | Weight | Input value | Normalization | Score | Source |
|---|---|---|---|---|---|
| Exploitation volume | 0.30 | 90 zero-days | ÷ 100 (2023 record) | 90.00 | Google Threat Intelligence Group |
| Enterprise concentration | 0.25 | 48% enterprise share | ÷ 50% ceiling | 96.00 | Google Threat Intelligence Group |
| Pre-disclosure exploitation | 0.25 | 28.96% of KEVs | ÷ 35% ceiling | 82.74 | VulnCheck |
| Patch-race deficit | 0.20 | −7 days mean time to exploit | 0d = 50, −14d = 100 | 75.00 | Mandiant |
ZDPI-2025 = (0.30 × 90.00) + (0.25 × 96.00) + (0.25 × 82.74) + (0.20 × 75.00) = 27.00 + 24.00 + 20.69 + 15.00 = 86.7
Every input is a row in the accompanying CSV with its source URL and retrieval date. Weights reflect what determines defender workload rather than headline drama: raw volume carries the most weight because it sets the response queue, and the patch-race deficit carries the least because it is an estimate rather than a count. The two normalization ceilings — 50% enterprise share and 35% pre-disclosure share — are stated design thresholds, not observed maxima.
How to read 86.7. This is the baseline reading, computed for calendar 2025 under the ZDPI-2026 specification. It carries no historical comparison, because the component series required to compute prior-year readings do not exist in published form. Future readings will be comparable to this one; readings computed under a revised specification will be re-baselined and labeled.
Scope. ZDPI measures pressure on defenders, not organizational risk. It says nothing about any single company’s exposure, which depends on its own asset inventory and internet-facing footprint far more than on the global count.
What Do Attackers Target With Zero-Days?
Enterprise vs. End-User Split, 2025
| Category | Zero-days | Share of 90 | Source |
|---|---|---|---|
| Enterprise software and appliances | 43 | 48% | Google Threat Intelligence Group |
| End-user platforms and products | 47 | 52% | Google Threat Intelligence Group |
| — Operating systems (desktop + mobile) | 39 | 44% | Google Threat Intelligence Group |
| — Desktop OS | 24 | 26.7% | Google Threat Intelligence Group |
| — Mobile OS | 15 | 16.7% | Google Threat Intelligence Group |
| — Browsers | <9 | <10% | Google Threat Intelligence Group |
Desktop OS count derived by Axis Intelligence Research as 39 total operating-system zero-days minus 15 mobile, both GTIG figures. GTIG separately describes desktop OS annual counts as fluctuating between 16 and 23 with a gradual upward trajectory; that range statement covers prior years.
Enterprise share rose from 36 zero-days (46%) in 2024 to 43 (48%) in 2025. Operating systems became the single most-exploited product category at 44%, up from 40% in 2024 and 33% in 2023. Browsers fell below 10% of the total — GTIG attributes this partly to hardening working and partly to attacker operational security improving.
The Security-Product Density Finding
Security and networking products made up 21 of the 43 enterprise zero-days in 2025, per GTIG. Axis Intelligence Research calculates that against the full year:
- 21 ÷ 43 = 48.8% of enterprise zero-days were in security or networking products
- 21 ÷ 90 = 23.3% of all zero-days — roughly one in four
That second ratio is the one worth carrying into a budget conversation. Nearly a quarter of everything exploited before a patch existed in 2025 was a flaw in a product category whose purpose is defense. GTIG’s technical read is unflattering and specific: missing input validation and incomplete authorization processes were common in these products.
Marcus Chen: No exotic memory-corruption chain required for most of the enterprise appliance work. Command injection and deserialization did a lot of the lifting, because they deliver reliable remote code execution without the exploit-development cost of a heap grooming chain. That is a supply-side story. When the cheapest reliable path into a network runs through a VPN concentrator’s admin interface, the price of a working exploit falls, and more actors can afford one.
Vendor Spread
Twenty vendors were exploited by exactly one zero-day each in 2025, according to GTIG — evidence that attackers are finding footholds across a widening product surface rather than concentrating on a handful of platforms. Cisco, Fortinet, Ivanti and VMware remained recurring targets, reflecting the value placed on VPNs and virtualization platforms.
Who Is Behind Zero-Day Exploitation?
GTIG attributed 42 of the 90 zero-days exploited in 2025. The remaining 48 (53.3%, Axis calculation) went unattributed.
Attributed Zero-Day Exploitation, 2025
| Actor category | Zero-days | Share of 42 attributed | Share of all 90 | Source |
|---|---|---|---|---|
| Commercial surveillance vendors | 18 | 42.9% | 20.0% | Google Threat Intelligence Group |
| State-sponsored espionage | 15 | 35.7% | 16.7% | Google Threat Intelligence Group |
| Financially motivated groups | 9 | 21.4% | 10.0% | Google Threat Intelligence Group |
| — of which PRC-nexus | 10 | 23.8% | 11.1% | Google Threat Intelligence Group |
Shares calculated by Axis Intelligence Research. The three categories sum exactly to 42, which is a useful internal consistency check on the source data. PRC-nexus groups are a subset of the state-sponsored figure.
Three shifts in that table are new for 2025. Commercial surveillance vendors out-attributed traditional state espionage groups for the first time since GTIG began tracking — a market-structure change, not a tactical one, and it means zero-day capability now reaches a wider customer base than ever. Financially motivated exploitation reached nine zero-days, nearly double the five attributed in 2024. And North Korean groups, credited with five zero-days in 2024, were attributed none in 2025.
The financially motivated column has names attached. GTIG documented CVE-2025-61882 and CVE-2025-61884 being exploited against Oracle E-Business Suite customers as early as August 9, 2025 — weeks before a patch — in intrusion activity that preceded a CL0P-branded extortion campaign. Separately, UNC2165 used CVE-2025-8088 to distribute malware in mid-July 2025, the first time GTIG observed that group using a zero-day for initial access.
How Fast Are Vulnerabilities Exploited After Disclosure?
This is where zero-day statistics blur into n-day statistics, and where the operational answer lives.
Mandiant’s M-Trends 2026 report, published March 23, 2026 and grounded in more than 500,000 hours of incident response during 2025, puts the mean time to exploit at an estimated −7 days. Negative. Exploitation routinely occurs before the patch ships.
Pre-Disclosure and Same-Day Exploitation
| Metric | 2024 | 2025 | 1H 2026 | Source |
|---|---|---|---|---|
| Vulnerabilities first exploited | — | 884 | 495 | VulnCheck |
| Exploited on or before CVE publication | 23.6% | 28.96% | 23.43% | VulnCheck |
| Median days, CVE publication → KEV | — | 120 | 80 | VulnCheck |
| CVEs reaching KEV within 31 days | 196 | 194 | ~200 | VulnCheck |
| KEV-to-CVE ratio | — | — | 1.4% | VulnCheck |
VulnCheck’s State of Exploitation 2026 report reports the 2025 pre-disclosure share as 28.96%; its State of Exploitation 1H-2026 analysis, published July 28, 2026, restates the same 2025 figure as 28.93%. We use 28.96% throughout and flag the discrepancy rather than smoothing it.
Applying 28.96% to the 884 first-time-exploited vulnerabilities gives 256 CVEs exploited on or before their publication date in 2025 (Axis calculation). GTIG’s 90 confirmed zero-days represent 35.2% of that group. The other 166 are the disclosure race — vulnerabilities weaponized within hours of becoming public, which are not zero-days by GTIG’s definition but are functionally indistinguishable to a team that patches monthly.
The 1H-2026 Reversal Nobody Has Priced In
Two numbers moved in opposite directions during the first half of 2026, and reading either one alone produces the wrong conclusion.
Pre-disclosure exploitation fell, from 28.96% to 23.43% — a 5.53 percentage point drop. Median time from CVE publication to confirmed exploitation also fell, from 120 days to 80 days, a 33.3% compression (Axis calculation). Less exploitation ahead of disclosure, faster exploitation after it.
The denominator explains most of it. VulnCheck reports that new KEVs grew 10% in 1H 2026 while CVE volume grew 45%, pushing the KEV-to-CVE ratio down to 1.4% from a 2.7% peak in the second half of 2023. Roughly 200 CVEs reached known-exploited status within 31 days of publication in 1H 2026, against 196 in 2024 and 194 in 2025 — early exploitation activity is close to flat in absolute terms while disclosure volume climbs around it.
Marcus Chen: Percentages fell because the pool got bigger, not because attackers slowed down. Roughly two hundred vulnerabilities crossed into confirmed exploitation within a month of disclosure this half — the same figure as the last two full years. If your prioritization queue is sorted by CVSS and fed by total CVE volume, that flat two hundred is drowning in a 45% larger haystack. Patching cadence is not the failing control here. Selection is.
Content management systems accounted for one-third of all KEVs in 1H 2026, the highest share VulnCheck has recorded, driven largely by the WordPress plugin ecosystem but extending to Drupal, Ghost and Kentico Xperience. Network edge devices continued to draw new KEV additions across Cisco, Palo Alto, Check Point, F5, Juniper, Fortinet, SonicWall, Ubiquiti and others.
How Much Exploitation Never Reaches the Public Catalog?
The CISA Known Exploited Vulnerabilities catalog is the reference most organizations treat as the definitive list of what is being exploited. Axis Intelligence Research built the Exploitation Visibility Coefficient (EVC) to quantify how much of the real exploitation landscape that catalog represents.
EVC = CISA KEV additions ÷ total first-time-exploited vulnerabilities, computed across three dimensions and averaged with equal weight.
EVC-2025 Calculation
| Dimension | CISA KEV, 2025 | VulnCheck KEV, 2025 | EVC | Outside CISA KEV |
|---|---|---|---|---|
| Vulnerabilities | 245 | 884 | 27.7% | 639 |
| Vendors | 99 | 518 | 19.1% | 419 |
| Products | 146 | 672 | 21.7% | 526 |
| Composite | — | — | 22.9% | 77.1% |
Both input sets are published by VulnCheck in its State of Exploitation 2026 report; the ratios and composite are Axis Intelligence Research calculations. Axis Intelligence Research estimates EVC-2025 at 22.9% — under a quarter of the newly exploited vulnerability landscape, by CVE, vendor and product count, is represented in the federal catalog.
This is not a failure of the catalog. CISA scopes KEV to what is high-impact and pervasive across the federal enterprise, and BOD 26-04 makes that scoping explicit by tying remediation deadlines to KEV presence. The number is a warning about substitution — treating a deliberately scoped federal prioritization list as a complete exploitation feed.
Live-Host Confirmation Tightens the Finding
VulnCheck observed exploitation against real vulnerable hosts it operates for 61 of the 495 vulnerabilities newly exploited in 1H 2026. Twelve of those 61 had been added to CISA KEV.
Axis Intelligence Research finds an EVC of 19.7% on live-host-confirmed exploitation for 1H 2026 — 49 of 61 vulnerabilities with direct evidence of attacks against real systems were absent from the federal catalog at the time of VulnCheck’s analysis. VulnCheck also reports adding exploitation evidence ahead of CISA more than 85% of the time in 2025, often by days or months.
Detection Concentration: Who Finds It First
Exploitation evidence in 1H 2026 was first reported by 79 distinct sources. Six of them accounted for 267 of the 495 vulnerabilities: Patchstack (70), CrowdSec (64), Shadowserver (57), VulnCheck (37), Wordfence (20) and CISA (19).
Axis Intelligence Research finds that 7.6% of reporting sources produced 53.9% of first-report coverage in 1H 2026 — the remaining 73 organizations accounted for 228 vulnerabilities between them. In 2025, 118 distinct sources were first to report across 884 vulnerabilities, an average of 7.49 each.
Marcus Chen: Two of the six are WordPress security firms and one is a crowd-sourced intrusion-detection network. The infrastructure that tells the world a vulnerability is under attack is narrower and more commercially contingent than the industry’s language about “the threat intelligence community” suggests. Lose two of those six feeds and the visible exploitation curve bends downward without a single attacker changing behavior.
Are AI-Discovered Vulnerabilities Driving More Zero-Day Attacks?
Short answer, on current evidence: no.
VulnCheck consolidated AI-attributed disclosure tracking with the Berkeley Vulnerability Research Initiative dataset and correlated the result against its KEV data. Across both datasets, 1,061 vulnerabilities were attributed to AI-assisted discovery. Fourteen — 1.32% (Axis calculation) — have confirmed in-the-wild exploitation, four of them observed against VulnCheck’s own instrumented hosts.
That conversion rate closely matches the exploitation rate across all vulnerabilities in the period.
| Stage | Count | Conversion | Source |
|---|---|---|---|
| Findings reported via Anthropic’s disclosure ledger | 23,019 | — | VulnCheck |
| Committed ledger entries at launch | 1,611 | 7.00% | VulnCheck |
| Published CVEs resulting | 126 | 0.55% of findings | VulnCheck |
| Confirmed exploited in the wild | 1 | 0.004% of findings | VulnCheck |
Conversion percentages calculated by Axis Intelligence Research. The single exploited case is CVE-2026-26980.
Axis Intelligence Research finds one confirmed in-the-wild exploitation per 23,019 AI-assisted vulnerability findings and per 126 published CVEs from that pipeline — the tightest published measurement of AI discovery-to-exploitation conversion available as of August 2026.
The offsetting trend is on the target side rather than the discovery side. VulnCheck identified 28 known exploited vulnerabilities in AI systems and observed exploitation activity across 10 of them, spanning model-building tools, workload-scaling platforms, AI gateways, agents and workflow automation. In LangFlow, attackers used CVE-2026-0769 and CVE-2026-5027 for initial access, harvested credentials, deployed cryptominers and attempted lateral movement. Neither vulnerability had been added to CISA KEV.
Marcus Chen: The hype cycle got the direction right and the magnitude wrong. AI is expanding the attack surface faster than it is expanding attacker capability — the exploited AI products are open-source orchestration tools holding privileged credentials, not novel machine-generated exploit chains. Show me an AI-discovered bug weaponized before disclosure and I will move the number. One CVE out of twenty-three thousand findings is not that.
How Zero-Day Exploitation Shows Up in Actual Breaches
The exploitation statistics converge with breach statistics in 2026 in a way they never have before.
Verizon’s 2026 Data Breach Investigations Report, published May 19, 2026, found that vulnerability exploitation accounted for 31% of breaches — surpassing stolen credentials as the top entry point for the first time in the report’s 19-year history. Mandiant’s M-Trends 2026 reports exploits as the most common initial infection vector for the sixth consecutive year at 32% of intrusions.
| Metric | Value | Source |
|---|---|---|
| Breaches starting with vulnerability exploitation | 31% | Verizon 2026 DBIR |
| Exploits as initial infection vector | 32% | Mandiant M-Trends 2026 |
| Mean time to exploit | −7 days | Mandiant M-Trends 2026 |
| Global median dwell time | 14 days | Mandiant M-Trends 2026 |
| Median dwell time, espionage and DPRK IT worker cases | 122 days | Mandiant M-Trends 2026 |
| Initial-access-to-handoff window | 22 seconds | Mandiant M-Trends 2026 |
| Breaches involving a third party | 48% | Verizon 2026 DBIR |
Two independent datasets, two methodologies, one point apart — 31% and 32% — is about as close to corroboration as this field produces. We publish them side by side rather than averaging, because DBIR counts confirmed breaches and M-Trends counts Mandiant investigations; the populations are not interchangeable.
The dwell time figure deserves a caveat that rarely travels with it. Global median dwell time rose to 14 days from 11, which reads like detection getting worse. Mandiant attributes the rise to caseload composition — espionage and North Korean IT worker investigations carried a 122-day median — while internal detection improved to 52% of cases from 43%.
Federal policy has already moved on this data. CISA’s Binding Operational Directive 26-04 replaced CVSS-driven prioritization with four risk inputs — public exposure, KEV status, exploit automatability and technical impact — requiring remediation within three days plus forensic triage where all four conditions are met. It revoked and replaced BOD 22-01, which had established the KEV catalog. CISA also issued BOD 26-02 on end-of-support edge devices during the same period.
Methodology
Collection. All statistics in this report were fetched and read from primary sources during the production session on August 10, 2026. Source documents: Google Threat Intelligence Group, “Look What You Made Us Patch: 2025 Zero-Days in Review” (March 5, 2026); Mandiant, M-Trends 2026 (March 23, 2026); VulnCheck, State of Exploitation 2026 (January 21, 2026); VulnCheck, State of Exploitation 1H-2026 (July 28, 2026); Verizon, 2026 Data Breach Investigations Report announcement (May 19, 2026); CISA BOD 26-04, BOD 26-02 and the Known Exploited Vulnerabilities catalog. Aggregator sites and secondary summaries were used only to locate primary documents, never as the source of a published figure.
ZDPI formula. ZDPI = (0.30 × V) + (0.25 × E) + (0.25 × P) + (0.20 × D), where V = min(annual zero-day count ÷ 100, 1) × 100; E = min(enterprise share ÷ 50, 1) × 100; P = min(pre-disclosure share ÷ 35, 1) × 100; D = 50 + (−MTTE ÷ 14) × 50, bounded to [0, 100]. The 2025 reading is 86.7. Ceilings of 100 zero-days, 50% enterprise share and 35% pre-disclosure share are stated design thresholds. The MTTE scale sets 0 days at 50 and −14 days at 100.
EVC formula. EVC = mean of (CISA KEV additions ÷ VulnCheck KEV additions) across vulnerabilities, vendors and products. EVC-2025 = mean(27.71%, 19.11%, 21.73%) = 22.85%, published as 22.9%.
Arithmetic. Every derived figure was computed in Python before drafting and re-run during verification. Results are reproducible from the CSV.
Methodology compatibility. We deliberately did not compute a single “share of CVEs exploited” figure by dividing 884 first-time-exploited vulnerabilities into 48,185 CVEs published in 2025. The numerator includes CVEs from prior years; the denominator does not. The compatible comparison is 90 zero-days against 48,185 published CVEs — 0.187%, or one in 535 (Axis calculation; CVE volume per the independent 2025 CVE Data Review by Jerry Gamblin, which is analysis of CVE Program data rather than a program publication and is flagged accordingly in the dataset).
Scope. Zero-day counts reflect detected and disclosed exploitation. Edge device exploitation is understated by GTIG’s own assessment because those devices largely lack EDR telemetry. Pre-disclosure exploitation shares use CVE publication date as a proxy for defender awareness, and VulnCheck notes that not every vulnerability exploited on or before CVE publication is a zero-day — some were disclosed in vendor advisories before a CVE was issued. EVC compares two commercial and federal catalogs with different scoping mandates; it measures coverage difference, not error.
About This Dataset
zero-day-statistics-2026.csv is the fact table for this article. Every number in the prose and every chart datapoint exists as a row, with source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated and method_note columns.
License: CC BY 4.0 — free to share and adapt with attribution.
Distribution: Hugging Face, Kaggle and GitHub, in addition to this page.
Cite This Research
APA — Axis Intelligence Research, & Chen, M. (2026). Zero-day statistics 2026: Exploitation counts, pre-disclosure attacks and the visibility gap. Axis Intelligence. https://axis-intelligence.com/zero-day-statistics/
MLA — Axis Intelligence Research, and Marcus Chen. “Zero-Day Statistics 2026: Exploitation Counts, Pre-Disclosure Attacks and the Visibility Gap.” Axis Intelligence, 10 Aug. 2026, axis-intelligence.com/zero-day-statistics/.
Chicago — Axis Intelligence Research, and Marcus Chen. “Zero-Day Statistics 2026: Exploitation Counts, Pre-Disclosure Attacks and the Visibility Gap.” Axis Intelligence, August 10, 2026. https://axis-intelligence.com/zero-day-statistics/.
Index citation — Axis Intelligence Research, Zero-Day Pressure Index (ZDPI), 2025 baseline reading 86.7, as of August 10, 2026.
Zero-Day Questions Security Teams Are Actually Asking
If we patch within 30 days, what percentage of exploited vulnerabilities are we still exposed to?
Roughly 200 vulnerabilities reached confirmed exploitation within 31 days of CVE publication in 1H 2026, against 495 newly exploited overall — about 40% of the half-year’s exploitation activity lands inside a 30-day window. A 30-day cycle is the boundary, not a margin. VulnCheck’s median CVE-to-exploitation interval of 80 days is the more forgiving number, and medians hide the tail that matters.
Should we treat CISA KEV as our exploitation feed or as our compliance floor?
As the floor. Axis Intelligence Research estimates EVC-2025 at 22.9%, and 49 of 61 vulnerabilities with live-host exploitation evidence in 1H 2026 were absent from the catalog. KEV is scoped to what is pervasive across federal systems, and BOD 26-04 now ties three-day remediation deadlines to it — which makes it authoritative for what it covers and incomplete for what it does not.
Does the drop in browser zero-days mean browser hardening solved the problem?
Partly, and GTIG says so — browsers fell below 10% of 2025 zero-days and hardening is credited. GTIG also assesses that attacker operational security improved, which would reduce observed exploitation without reducing actual exploitation. Both effects are present; neither has been isolated.
Why did commercial surveillance vendors overtake state-sponsored groups, and does it change our threat model?
For most enterprises, no. CSVs accounted for 18 of 42 attributed zero-days in 2025, and their exploitation concentrates on mobile and browser chains against individuals rather than enterprise infrastructure. The relevant change is market structure: zero-day capability is now brokered to a wider customer base, which raises the probability that a given exploit reaches an actor with different targeting priorities than its original buyer.
Our appliances are our security controls. How exposed is that assumption?
Axis Intelligence Research finds 23.3% of 2025 zero-days — 21 of 90 — were in security and networking products, and GTIG attributes the common flaws to missing input validation and incomplete authorization rather than exotic bugs. Edge devices accounted for 14 zero-days and are the hardest category to forensically examine after compromise, since minimal onboard storage and absent EDR leave few artifacts.
Is a mean time to exploit of −7 days a real measurement or a rhetorical device?
A real estimate, published by Mandiant in M-Trends 2026, derived from incident response data across 2025. It means that averaged across observed cases, exploitation preceded patch availability by a week. It does not mean every vulnerability is exploited before patching; it means the distribution’s center has crossed zero, which changes what a patch SLA can accomplish on its own.
Do we need to add AI infrastructure to our vulnerability management scope?
Yes, on target-side evidence rather than discovery-side hype. VulnCheck identified 28 known exploited vulnerabilities in AI systems with exploitation observed across 10, including LangFlow initial access via CVE-2026-0769 and CVE-2026-5027 followed by credential harvesting and cryptomining. Meanwhile only 1.32% of 1,061 AI-assisted-discovered vulnerabilities have confirmed exploitation — the tools are a bigger exposure than the technique.
How should we prioritize now that BOD 26-04 has retired CVSS-first triage?
BOD 26-04 binds federal civilian agencies to four inputs — public exposure, KEV status, exploit automatability and technical impact — with three-day remediation plus forensic triage when all four are met, and explicit permission to defer the rest. It replaced BOD 22-01 and BOD 19-02. Private-sector organizations are not bound by it, but its structure is the clearest published statement of how the agency that maintains KEV thinks exploitation risk should be ranked.
Which single number belongs in a board update?
ZDPI 86.7, with the composition behind it. The zero-day count moved 15.4% year over year, which invites an argument about noise. The pressure reading combines volume with where exploitation landed, how much of it beat disclosure, and how the patch race is trending — and the one-in-four figure for security and networking products is what makes the case concrete.