New research from Picus Security highlights a troubling acceleration in the cyber threat landscape: attackers are now weaponizing disclosed vulnerabilities faster than organizations can deploy patches. The firm warns that the window between a vulnerability's public disclosure and its active exploitation has narrowed dramatically, leaving defenders scrambling.
This shift poses severe challenges for security teams. Even when no public exploit code exists, attackers can craft functional exploits based solely on technical details in vulnerability disclosures. Picus found that the mean time to exploitation for critical vulnerabilities has dropped significantly, with some being targeted within hours of disclosure.
The technical mechanism relies on automated exploit generation and the proliferation of proof-of-concept code within criminal forums. Indicators of compromise may include anomalous network traffic patterns and unexpected system behavior, though specific signatures vary by vulnerability. Picus emphasizes that the absence of a public exploit does not mean an organization is safe.
To counter this trend, Picus recommends that security teams adopt proactive validation tools to simulate exploitability within their environments. Such testing can identify vulnerable assets before attackers do, enabling prioritized patching. The firm notes that automated validation can reduce the mean time to remediation by up to 90%.
While no specific threat actor or campaign is named, Picus links this trend to the broader commoditization of exploit development. The findings underscore a growing asymmetry between attack speed and defense readiness, a gap that security leaders must urgently address.