The Patch Gap: Why Traditional Vulnerability Management Won’t Cut It in Today’s Threat Landscape
Imagine being told that, on average, it takes just four hours for attackers to exploit a newly discovered vulnerability after it’s publicly disclosed. Sounds alarming? That’s exactly what’s happening right now. The rate at which vulnerabilities are being exploited has increased dramatically over the years, leaving defenders struggling to keep pace.
Recent breakthroughs in AI-powered vulnerability discovery have led to the identification of thousands of high-severity vulnerabilities, many of which have gone unpatched for decades. This is not a patch management problem; it’s a “patch physics” issue. The sheer volume of newly discovered vulnerabilities has created a perfect storm that traditional patching methods can no longer handle.
The numbers are staggering. In 2025 alone, over 46,000 Common Vulnerabilities and Exposures (CVEs) were published, with nearly 42,000 enriched by the National Institute of Standards and Technology. The exploitation window has shrunk dramatically as well; in 2018, it took attackers an average of 771 days to exploit a vulnerability after disclosure. Fast forward to 2024, and that number had dropped to just four hours.
The traditional approach to vulnerability management – sorting vulnerabilities by Common Vulnerability Scoring System (CVSS) scores and patching the highest-scoring ones first – simply won’t work anymore. CVSS was never designed for prioritization, yet it’s become a default operating logic for many security teams. The problem is that CVSS scores measure the maximum impact against an abstract target, not the actual risk to specific assets.
In reality, attackers don’t care about CVSS scores; they’re focused on breaking chains to critical assets. A recent example of this was Operation Lunar Peek, where attackers exploited a medium-severity vulnerability (CVE-2024-9474) to bypass a more severe one (CVE-2024-0012), resulting in the compromise of 2,000 Palo Alto Networks Firewalls.
So, what’s the solution? Security teams need to shift their focus from checklists to chain thinking. Instead of asking which vulnerabilities are most severe in isolation, they should ask: “Which vulnerabilities, if left unpatched, create a connected path from an attacker’s foothold to our most critical assets?” This requires a graph-based approach that incorporates attack path aggregation and asset interdependencies.
By modeling the environment as a directed graph, where nodes represent assets and system states, and edges represent exploitable transitions between them, security teams can evaluate relationships between vulnerabilities and calculate risk scores for assets with multiple vulnerabilities. This is not about patching faster or scoring harder; it’s about rethinking the way we approach vulnerability management.
The takeaway is clear: traditional vulnerability management methods are no longer effective in today’s threat landscape. Security teams need to adapt and adopt a more proactive, chain-based approach to stay ahead of attackers. By doing so, they can reduce the patch gap and prevent the next Operation Lunar Peek from happening on their watch.
Source: Dark Reading — 2026-08-10