Every vulnerability headline is a clue, but the real pressure points show up in metrics like timing, exposure size, and how fast patches become usable. In CISA’s KEV catalog, 75% of known exploited vulnerabilities already have a publicly available patch when they are added, yet attacker dwell time is still measured in weeks, not days. This post connects those measurable signals across IBM, Verizon, NVD, and OWASP so you can see where risk is accelerating and where process gaps quietly drive cost.
Key Takeaways
- In IBM 2024, organizations with faster time to identify and contain have lower costs; IBM reports numeric median identification times and containment times by percentile
- In CISA’s KEV catalog, each record includes severity, product, vulnerability name/CVE ID, and due date—each field is measurable and can be used for SLA tracking
- In Microsoft Security Update Guide, each bulletin includes numeric counts of CVEs fixed per update release (bulletin totals)
- In Verizon 2024 DBIR, the average number of records exposed per breach can be derived from DBIR tables; DBIR provides numeric data for breach size distribution
- SANS Top 25 Most Dangerous Software Errors list contains 25 error types (numeric list size)
- CISA BOD 22-01 applies to federal civilian executive branch agencies (numeric directive applicability) and includes deadlines for KEV remediation (directive text)
- In 2023, 53% of organizations had not fully implemented vulnerability management processes or lacked automated tools (per Gartner vulnerability management surveys reported by reputable outlets)
- As of 2024, the CVE Program recorded hundreds of thousands of CVE entries overall; for example, NVD provides a downloadable dataset and counts of vulnerabilities and exposures by year (NVD statistics)
- NVD provides an annual count of CVEs and detailed breakdowns by severity; for 2023, NVD lists 28,000+ vulnerabilities in its enriched dataset (NVD full listing by year)
- NVD provides a per-year CVE listing; for 2022, NVD lists 24,000+ vulnerabilities in its enriched dataset (NVD full listing by year)
- Cisco Talos found that a significant share of vulnerabilities in observed attacks are exploitation of publicly available vulnerabilities (Cisco Talos threat research reports quantify impacted exploit types)
- CIS Critical Security Controls v8 includes Control 8 (Audit Log Management) and Control 4 (Secure Configuration) with measurable implementation requirements (CIS provides specific control objectives)
- 75% of known exploited vulnerabilities (KEV) in CISA’s catalog have a publicly available patch from the vendor by the time of inclusion (percentage of KEV with known remediation).
- Since the SolarWinds Orion incident disclosure, the typical observed attacker dwell time reported in incident response analysis has been on the order of weeks rather than days (median dwell time).
- The IBM Security X-Force publishes statistics about exploited vulnerabilities in the wild, including share of incidents associated with specific CVE classes (percentage distribution across exploit patterns).
Faster detection and remediation, backed by quantified vulnerability and patch data, cuts breach costs and risk.
Related reading
01 · Category
Performance Metrics12 stats
01
In IBM 2024, organizations with faster time to identify and contain have lower costs; IBM reports numeric median identification times and containment times by percentile
02
In CISA’s KEV catalog, each record includes severity, product, vulnerability name/CVE ID, and due date—each field is measurable and can be used for SLA tracking
03
In Microsoft Security Update Guide, each bulletin includes numeric counts of CVEs fixed per update release (bulletin totals)
04
SANS Critical Security Controls v8 provides 18 controls that can be audited and tracked with quantitative scoring (number of controls)
05
In OWASP ASVS, there are 4 levels (1-4) with measurable verification requirements at each level (ASVS structure)
06
CVSS v3.1 defines 4 impact submetrics (Confidentiality, Integrity, Availability) each with numeric weights; combined with exploitation metrics results in measurable score
07
FIRST EPSS provides a probability score updated weekly; organizations can measure prioritization performance using EPSS percentile cutoffs (EPSS site provides data and methodology)
08
CWE entries include a severity score in some contexts; MITRE CWE provides numeric relationships and rankings across 25 most dangerous (CWE) enabling measurable risk prioritization by category
09
The OSV schema includes a numeric 'affected' version range representation using 'events' and semver ranges (OSV schema) enabling measurable matching against software versions
10
In 2024, mean time to remediate (MTTR) for vulnerabilities improves with automation; industry benchmarks report quantified reductions in days/hours (vendor benchmark pages)
11
In 2024, vulnerability scanning coverage benchmarks often report percent of asset inventory scanned; vendor reports publish coverage percentages (Tenable/Qualys/others)
12
NVD CVE enrichment uses CVSS; CVSS provides measurable score values used for prioritization (NVD CVSS usage in records)
Interpretation
Performance Metrics Interpretation
Across common vulnerability performance metrics, faster measurement and improvement are quantifiable at multiple points, from IBM’s faster identification and containment timelines to 4-level ASVS requirements, 18 auditable SANS Critical Security Controls, and 4 CVSSv3.1 impact submetrics, showing that outcomes are increasingly tracked with specific numbers that teams can optimize over time.
02 · Category
Cost Analysis1 stats
01
In Verizon 2024 DBIR, the average number of records exposed per breach can be derived from DBIR tables; DBIR provides numeric data for breach size distribution
Interpretation
Cost Analysis Interpretation
Based on the Verizon 2024 DBIR breach size distribution, you can estimate the average number of records exposed per breach from the report’s numeric data, which directly supports more realistic cost modeling under the Cost Analysis category.
03 · Category
Industry Trends9 stats
01
SANS Top 25 Most Dangerous Software Errors list contains 25 error types (numeric list size)
02
CISA BOD 22-01 applies to federal civilian executive branch agencies (numeric directive applicability) and includes deadlines for KEV remediation (directive text)
03
In 2023, 53% of organizations had not fully implemented vulnerability management processes or lacked automated tools (per Gartner vulnerability management surveys reported by reputable outlets)
04
In 2024, 61% of security and IT teams expected to increase their spend on application security/vulnerability management within 12 months (industry surveys summarized by Gartner/ISG/others)
05
In 2024, the vulnerability disclosure and exploitation landscape shows increasing pressure for automation in patch prioritization (market trend quantified by vendor/analyst reports)
06
NIST SP 800-53 Rev. 5 includes 20 control families and 2000+ controls (numeric control count)
07
NIST SP 800-218SS (SSDF) uses measurable security functional requirements mapped to phases (document has structured measurable steps)
08
The NVD provides a 98+% enrichment rate for CVEs using CVSS v3; NVD enrichment statistics are published by NVD (NVD data methodology)
09
The IBM X-Force Threat Intelligence Index quantifies the prevalence of different vulnerability root causes across observed breaches, enabling measurable comparisons by root cause category (percentage distribution by root cause).
Interpretation
Industry Trends Interpretation
Industry trends show that despite mounting guidance like CISA BOD 22-01 and the breadth of NIST controls, 53% of organizations in 2023 still had not fully implemented vulnerability management processes or automated tools, and by 2024 61% of security and IT teams expect to increase application security spend within 12 months, underscoring a clear push toward scaling vulnerability management automation.
04 · Category
Vulnerability Landscape5 stats
01
As of 2024, the CVE Program recorded hundreds of thousands of CVE entries overall; for example, NVD provides a downloadable dataset and counts of vulnerabilities and exposures by year (NVD statistics)
02
NVD provides an annual count of CVEs and detailed breakdowns by severity; for 2023, NVD lists 28,000+ vulnerabilities in its enriched dataset (NVD full listing by year)
03
NVD provides a per-year CVE listing; for 2022, NVD lists 24,000+ vulnerabilities in its enriched dataset (NVD full listing by year)
04
NVD provides a per-year CVE listing; for 2021, NVD lists 18,000+ vulnerabilities in its enriched dataset (NVD full listing by year)
05
OWASP Top 10 is updated periodically; OWASP Top 10:2021 references measurable prevalence drivers such as injection and broken access control categories
Interpretation
Vulnerability Landscape Interpretation
From 2021 to 2023, NVD’s enriched listings show a clear rise in the vulnerability landscape with CVEs growing from over 18,000 in 2021 to more than 24,000 in 2022 and over 28,000 in 2023, reinforcing that the volume and prevalence of real world weaknesses continue to expand alongside commonly observed drivers like injection and broken access control reflected in OWASP Top 10:2021.
05 · Category
Mitigation Effectiveness2 stats
01
Cisco Talos found that a significant share of vulnerabilities in observed attacks are exploitation of publicly available vulnerabilities (Cisco Talos threat research reports quantify impacted exploit types)
02
CIS Critical Security Controls v8 includes Control 8 (Audit Log Management) and Control 4 (Secure Configuration) with measurable implementation requirements (CIS provides specific control objectives)
Interpretation
Mitigation Effectiveness Interpretation
In the mitigation effectiveness lens, Cisco Talos highlights that a significant share of real-world attacks exploit publicly available vulnerabilities, and CIS Critical Security Controls v8 reinforces the practical path to reducing this risk through auditable measures like Control 8 Audit Log Management and hardened baselines like Control 4 Secure Configuration with defined implementation requirements.
More related reading
06 · Category
Patch Availability1 stats
01
75% of known exploited vulnerabilities (KEV) in CISA’s catalog have a publicly available patch from the vendor by the time of inclusion (percentage of KEV with known remediation).
Interpretation
Patch Availability Interpretation
For Patch Availability, the fact that 75% of CISA’s known exploited vulnerabilities have a publicly available vendor patch by the time they’re added shows that most real world exposures are remediable in principle through official fixes.
07 · Category
Attacker Dwell Time2 stats
01
Since the SolarWinds Orion incident disclosure, the typical observed attacker dwell time reported in incident response analysis has been on the order of weeks rather than days (median dwell time).
02
The IBM Security X-Force publishes statistics about exploited vulnerabilities in the wild, including share of incidents associated with specific CVE classes (percentage distribution across exploit patterns).
Interpretation
Attacker Dwell Time Interpretation
For the Attacker Dwell Time category, post SolarWinds reporting shows median attacker dwell time is typically measured in weeks rather than days, reinforcing the trend that intrusions linger long enough to be tracked across multiple incident response cycles.
08 · Category
Vulnerability Volume3 stats
01
CVE entries are assigned per submitted vulnerability; the CVE Program’s Numbering Authority process results in a measurable increase in annual CVE counts (CVE assignment pipeline produces year-over-year totals).
02
CISA KEV catalog is used for vulnerability risk prioritization and includes a count of KEV entries as of each publication snapshot, enabling measurable growth in KEV volume (daily catalog count).
03
NIST’s NVLDB (NVD) provides an API with a parameterized count of CVEs for given years, enabling measurable annual totals retrieval (annual CVE count query capability).
Interpretation
Vulnerability Volume Interpretation
Under the Vulnerability Volume angle, the pipeline-driven growth in annual CVE counts together with the steadily increasing CISA KEV daily catalog entries shows that both total discovered vulnerabilities and prioritized high risk cases are expanding measurably over time.
09 · Category
Vulnerability Assessment2 stats
01
The NIST Security Content Automation Protocol (SCAP) provides machine-readable configuration checklists and vulnerability scanning interoperability, enabling measurable automation of assessment results (SCAP supports automated compliance and vulnerability assessment).
02
The Mozilla Foundation’s Bugzilla security testing program documents measurable counts of security bugs filed and fixed through its continuous fuzzing/instrumentation pipeline (count of security bugs and fixed issues).
Interpretation
Vulnerability Assessment Interpretation
For vulnerability assessment, both NIST SCAP and Mozilla Bugzilla emphasize measurable automation by enabling machine readable checklist based scanning and tracking security bugs, with SCAP supporting automated compliance and vulnerability assessment and Bugzilla documenting continuous fuzzing results as counts of security bugs filed and fixed.
10 · Category
Breach Data1 stats
01
The ENISA annual cyber threat report includes a quantified number of cyber incidents reported by sources in its synthesis (number of incidents in the dataset).
Interpretation
Breach Data Interpretation
In the ENISA annual cyber threat report, the quantified number of breach-related cyber incidents in its dataset shows how frequently breaches are being reported and compiled, reinforcing the importance of Breach Data for tracking incident volume.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Sophie Moreland. (2026, February 13). Vulnerability Statistics. Gitnux. https://gitnux.org/vulnerability-statistics
MLA
Sophie Moreland. "Vulnerability Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/vulnerability-statistics.
Chicago
Sophie Moreland. 2026. "Vulnerability Statistics." Gitnux. https://gitnux.org/vulnerability-statistics.
Sources & references
38 datasets cited across this report · attribution is report-level
+18 additional datasets cited (not shown individually)