// TRENDS

Trends from published reports

These figures come from reports that other organizations publish a few times a year. They do not update with our scheduled runs. Each one shows its source and the date it was published.

NEWEST REPORT CITED: JUL 28, 2026

DISCLOSURE TO EXPLOITATION

80d

▼ WAS 120

Median days from a flaw going public to known use in attacks, first half of 2026.

SRC: VULNCHECK 1H 2026 · JUL 28, 2026

EXPLOITED BY DAY ONE

23%

▼ WAS 29%

Share of exploited flaws attacked on or before the day they were published.

SRC: VULNCHECK 1H 2026 · JUL 28, 2026

AI-FOUND BUGS EXPLOITED

1.3%

= BASELINE

14 of 1,061 AI-found flaws. About the same rate as all flaws.

SRC: VULNCHECK 1H 2026 · JUL 28, 2026

// DRIVERS

Why this is happening

AI is finding more bugs. Flaws logged in the US vulnerability database in 2026 are on pace to double 2025. The share used in attacks has not risen with them. Bloomberg Law, Jul 27, 2026

Attackers move sooner. The median time from a flaw going public to known use in attacks fell to 80 days, from 120. About 1 in 4 exploited flaws is attacked by the day it is published. VulnCheck, Jul 28, 2026

Exploited flaws are now the top way in. They started 36% of breaches in 2026, ahead of stolen passwords. Verizon DBIR 2026 via CXO Digital Pulse, May 20, 2026

FOUND VS USED · INDEX: PRIOR PERIOD = 100

Twice the bugs. Barely more exploitation. Less time.