The Patch Window

The patch window is the gap between the moment a vulnerability is disclosed and the moment a fix is deployed on your systems. For most of the last two decades that gap was measured in weeks or months, and enterprise patch cycles were built around that assumption.

That assumption no longer holds. In 2018 the median interval between disclosure and first observed exploitation was 771 days. Defenders had over two years. By 2021 that had compressed to 84 days, by 2023 to six days, and by 2025 the majority of exploited vulnerabilities were weaponized before they were publicly disclosed at all.

The figures come from the Zero Day Clock, a dataset of more than 3,500 CVE-exploit pairs compiled from CISA KEV, VulnCheck KEV and XDB. The live view below tracks it so the trend can be checked rather than asserted.

Why the patch window matters

A patch cycle that takes 30 to 45 days is not a defect of the organizations running it. Testing, change approval and staged rollout exist for good reasons, and skipping them causes outages. The problem is arithmetic. When the interval to a working exploit is shorter than the interval to a deployed patch, the exposure is structural rather than operational, and no amount of patching faster closes it.

What closes the gap when a patch cannot

Exploiting a vulnerability still requires making an unauthorized change to a protected component: writing a new binary, modifying a registry key, loading a driver, altering a service. Known-good enforcement evaluates that change at the kernel against a verified baseline of the system's authorized state, and blocks it when it falls outside. The vulnerability can exist and the exploit can run. The change it depends on does not execute.

This is how Mimic Virtual Patching covers the exposure window between disclosure and patch deployment, and how it covers end-of-life systems that will never receive another fix. Related reading: The Exploit Path and the Known-Good Enforcement Glossary.

About this data

Figures are compiled from public vulnerability and exploitation reporting. The live view below is updated as new records are published.