Cybersecurity is almost impossible to measure.We are trying anyway.

Because it fails in three separate ways, and each of them flattens the line for reasons that have nothing whatever to do with attacker behaviour.

First, and most importantly, it ignores aging. The metric compares years that have had wildly different amounts of time in which to accumulate evidence. A vulnerability published six years ago has had six years in which somebody might notice it being exploited, whereas one published last quarter has had a few weeks. Recent years therefore look artificially fast and older years look artificially slow, and a large part of any trend you draw through them is simply the passage of time rather than a change in the world.

Second, it saturates. Time to exploitation is floored at zero. Once a large share of exploitation is landing on the day of publication, the metric has nowhere left to go and cannot represent any further acceleration. A vulnerability exploited quietly for months before anybody knew it existed and one exploited on the morning of disclosure both record the same value, which is to say the metric stops being able to tell apart the two situations that matter most.

Third, the next real change would move both ends at once, and an average cannot show that. As the cost of finding and weaponising a vulnerability falls, we would expect to see more exploitation arriving at or before disclosure, and at the same time more exploitation of the long tail of older vulnerabilities that was previously protected by nothing more than attacker labour cost. That tail is already where a great deal of the damage sits. Mass moving toward zero and a tail growing fatter offset one another inside a mean, so the number could sit perfectly still while both halves of the distribution moved.

We are not claiming that this shift has already happened. We are saying that a time to exploitation metric could not tell you whether it had, and that on its own is reason enough to stop using it.

A KEV catalogue entry is a decision somebody made, not a measurement somebody took. The CISA KEV catalogue exists in order to tell United States federal agencies what to patch, and it is very good at that job. It is a remediation directive with a legal deadline attached to it, which makes it government shaped in ways that matter a great deal if you read it as a picture of the world instead.

It sets severity aside deliberately, because the purpose is the last mile of getting something patched rather than how badly it scores. An entry also tends to appear only once there is already enough public evidence and pressure to justify adding one. A KEV catalogue is therefore closer to a last warning that something is being heavily exploited than to an early signal that it might be. It is a useful and honest instrument, and it is a biased one, and both of those things are true at the same time.

That is why this site reads four KEV catalogues rather than one, keeps them separate instead of merging them into a single number, and measures how much they disagree. Where a chart here says KEV it means all four unless it states otherwise, which is roughly three times the population of the CISA KEV catalogue on its own.

No, and we think conflating the two is one of the easiest ways to inflate a vulnerability dataset without anybody noticing. Exploit code existing is a statement about what the world knows. Exploitation is a statement about what somebody actually did. They are different claims that deserve different standards of evidence.

This project counts two things only: listings in a KEV catalogue, and exploitation attempts observed by honeypot sensor networks. We do not track proof of concept repositories, exploit marketplaces or published exploit kits, and none of that material contaminates any figure on this site. If a chart here says a vulnerability was exploited, it means a KEV catalogue listed it as such or a sensor recorded somebody attempting it.

Because the denominator underneath is not stable. KEV catalogues widen their coverage, sensors come and go, and a rate computed across several years mostly ends up tracking how hard somebody was looking. Dividing a window by the same window twelve months earlier compares like with like, because both halves are subject to the same seasonal shape and a source that was present in both periods cancels itself out.

It is a deliberately unclever statistic. There is one division in it, with nothing fitted and nothing predicted. A better calibrated estimator would be blind to precisely the structural breaks that we most need to be able to see.

Usually because the two figures are counting different things. The word exploited can mean that a KEV catalogue listed it, that a vendor said so, that a sensor observed an attempt, or that exploit code exists somewhere. Those are four different claims with four different standards of evidence behind them, and this site keeps them apart on purpose rather than adding them together.

Every chart states its observation window, its censoring date and the version of the method that produced it. If a figure cannot be reproduced from the published data and the published code then you should treat it as wrong, and we would be glad to hear about it.

Because it genuinely is incomplete, and saying so is more useful than quietly hiding it. A vulnerability published last month has had a month in which somebody might observe it, whereas one published in 2019 has had years. Recent periods are right censored, so charts here mark incomplete periods explicitly rather than letting a shortage of follow up time read as though it were a decline.