Jira tickets used to sit open for years. A medium-severity vulnerability, flagged by a routine scan, could be assigned to an engineer who had bigger fires to fight. It had largely been that way for years: patch the criticals, manage the highs, let the mediums age. When it came to CVEs (Common Vulnerabilities and Exposures), a publicly available list of known cybersecurity flaws in software and hardware, nobody was going to weaponize one rated 5.4. But in today\u2019s world, that\u2019s no longer true.<\/p>\n\n\n\n
\u201cIn 2020, if there was a CVE reported and a security hole, it would take more than a year until there was a public exploit,\u201d said Shimon Tolts, CEO and co-founder of cloud security startup Copperhelm. \u201cNowadays, with Claude and OpenAI and other players, the time has shrunk from one year to one day. So now you treat every CVE, every security issue that you have, as immediately exploitable.\u201d<\/p>\n\n\n\n
The data confirms what Tolts describes. The mean time between a vulnerability being discovered and its exploitation has dropped from nearly a year in 2021 to just over a day<\/a> in 2026, with industry projections suggesting the window will shrink to one hour by 2027. Rapid7\u2019s 2026 Global Threat Landscape Report found that what once unfolded over weeks now materializes in days (and in some cases, minutes), with the median time between vulnerability publication and inclusion on CISA\u2019s Known Exploited Vulnerabilities catalog falling from 8.5 days to five.<\/a><\/p>\n\n\n\n