Zero Day Clock — a public scoreboard for vulnerability management and exploitation

How to read it

Every number is what happened in the last three complete months divided by what happened in the same three months one year earlier. One division, nothing fitted and nothing predicted, so 100% means only that this quarter matched last year. It is a SHARE OF last year, not a change: 270% means this quarter is 2.7 times last year, which is a rise of 170%. 100% is not the same as normal. These streams grow, so an ordinary quarter reads above 100%: the typical reading is 119% on vulnerability pressure, so the honest question is whether a reading is unusual FOR THAT STREAM, not whether it clears 100%. Vulnerability pressure counts every CVE record published in the window. Scanning pressure takes the hundred busiest vulnerabilities, re-picked each month, averages each one over the days it was actually seen, and sums those rates. It is a daily rate, not a count of attempts, and not every one of the hundred is a CVE. Zero Day Exploitation pressure counts CVEs whose first KEV listing is dated no later than their own publication day — 37 of the latest 97 dated before it, 60 on the same day. Both dates are records of when somebody wrote something down, so this establishes neither when exploitation began nor that no patch existed: of the 216 with a vendor fix date on file, 91% were patched on or before disclosure — but every one of those dates comes from Microsoft’s security updates, so that share covers about a tenth of the stream and one vendor. Each stream is compared only with its own past, never with the other two, because the three share no unit.

How to read it

Each ribbon is the share of honeypot attempts aimed at CVEs of that age, measured at the end of each month. The stack height is traffic against that month’s hundred most-probed CVEs, not all traffic — it covers 70% to 88% of it. The easy misreading is the total: it moves with how many sensors reported, not only with how much scanning happened, which is why Share sits beside it and the two disagree in direction. An attempt is somebody aiming an exploit at a sensor; it is not a compromise, and it is not a victim.

How to read it

One dot is one CVE, placed on the year its CVE record was published, at the difference in days between the earliest date any of four KEV catalogues carries for it and that publication date. Colour is the catalogue supplying that earliest date. The sign is about which record came first, not about attackers. Below zero a catalogue holds a date earlier than the CVE record — usually because a vendor advisory went out first and the CVE record followed, not because exploitation preceded disclosure. Zero means the two dates fall on the same day, and at day precision nothing distinguishes that from an order we simply cannot see. Above zero a catalogue wrote it down after the record existed, which is a reporting delay and not a measure of how long exploitation took. This is not a zero-day count, the axis is not uniform, and the column counts are not comparable with each other — all three are explained under “How this is calculated”.

How to read it

Annual counts every vulnerability once, in the year a catalogue first listed it as exploited. Each band is one technology domain, and the number above the stack is the same annual KEV total shown in the charts above. Monthly divides those same counts by the months covered; Share shows each domain as a percentage of that year’s total. Tap or hover a year for the category values. What it means. Web publishing and plugins went from 6.3 to 52.4 a month while operating systems barely moved, 6.9 to 6.9. Nothing moved away from the operating system — the other categories grew around it, so a smaller share of a bigger total is not a fall. The series starts in 2021 because earlier catalogue coverage is not comparable. About 70% of 2026’s listings name the technology outright; the remainder use the advisory text or a stated prior, so treat the smallest bands as indicative.

How to read it

Each row is a rule for what goes on the patch list. Left: how many CVEs it adds each month, and the backlog it starts with. Right: of the CVEs attackers went after, the share already on that list, and how many it left open. Newly targeted keeps only CVEs these sensors had not seen attacked in the 50 days before (CrowdSec only from 24 Aug), the strict test. KEV: a published list of vulnerabilities known to be exploited. EPSS: FIRST’s daily estimate of the chance a CVE is attacked in the next 30 days. CVSS: the 0–10 severity score.