At A Glance
- Vulnerability disclosures run into the tens of thousands a year and are forecast near 66,000 for 2026, while even high-priority findings take a median of 32 days to remediate.
- Attackers exploit new vulnerabilities in a median of five days, so the remediation clock loses to the exploitation clock by an order of magnitude.
- The backlog is structural rather than a staffing or tooling shortfall, and patching faster cannot close a gap that large.
- Vulnerability cloaking removes an asset’s reachability, so an unpatched flaw has no network path an attacker can use.
- Cloaking takes you out of the patch race instead of helping you run it faster.
Vulnerability Cloaking Series · Part 1 of 6
Every security team runs the same race, and every security team loses it by the same margin. Vulnerabilities arrive faster than you can fix them, your backlog grows quarter over quarter, and you give the board the same explanation each time: your team needs more people, better scanners, and tighter change windows.
Treat the backlog as a performance problem and you will chase it forever, because the backlog isn’t a performance problem; it’s structural, and the math doesn’t favor you.
Two Rates That Do Not Match
Start with the rate at which vulnerabilities appear. The National Vulnerability Database recorded more than 40,000 CVEs in 2024, a 38% increase over 2023. For 2026, the Forum of Incident Response and Security Teams raised its mid-year forecast to roughly 66,000 CVEs, driven by AI-assisted vulnerability discovery. Whatever number a given year lands on, for the last decade the number has always gone up.
Verizon’s 2025 Data Breach Investigations Report studied how quickly organizations closed a set of edge and VPN vulnerabilities, and found that only 54% were fully remediated, at a median of 32 days. For the specific set of edge device vulnerabilities the report analyzed, the average time to patch ran to 209 days.
Combine those two data points and you can clearly see the disconnect: disclosures climb into the tens of thousands a year, and even a focused, high-priority slice of them takes a median of a month, and often most of a year, to close.
The Clock Runs Against the Defender
The gap between vulnerability discovery and remediation rates would be survivable if attackers waited politely for you to finish. They don’t.
The DBIR found that vulnerability exploitation rose 34% year over year and now factors into 20% of breaches, and that the average time from disclosure to exploitation is five days. Exploitation of edge and VPN devices, the assets sitting directly on the internet, surged nearly eightfold in a single year, from 3% to 22% of the studied breaches.
Set the clocks side by side. The attacker’s clock starts at disclosure and reaches exploitation in a median of five days. Your clock starts at the same moment and reaches remediation in a median of 32 days, if the vulnerability is one of the lucky 54% that gets fixed at all. In this race, you’re behind by an order of magnitude, and adding staff or shortening a change window moves your number from 32 days toward 25, which loses to five just as decisively as 32 does.
Volume Is Not the Same as Risk
FIRST noted that once you filter the flood for real-world risk, meaning entries in CISA’s Known Exploited Vulnerabilities catalog or a high EPSS score, the actionable patching burden has not materially increased. Most of the 66,000 will never be weaponized against you. The volume is more alarming than the risk it describes.
Filtering the backlog to the vulnerabilities attackers are using leaves you with a smaller list, and the five-day exploitation clock applies to exactly that list. The vulnerabilities that matter are the ones exploited fastest, which means the slice you most need to close is the slice you have the least time to reach. Prioritization tells you which fire to run toward. It does nothing to make you faster than the attacker.
Stop Running the Race
Every remedy aimed at the backlog tries to make your clock faster: scan more often, prioritize more sharply, automate the change ticket, hire another analyst. Each remedy accepts the premise that you have to reach the vulnerable asset before the attacker does. That premise is the trap, because the math guarantees you cannot win this race.
The way out is to stop treating reachability as fixed. A vulnerability is only dangerous when an attacker can reach the service that carries it. Take away the reachability and the unpatched flaw still exists in the code, still shows up in the scanner, yet can’t be exploited because there is no path to it. That is vulnerability cloaking: a compensating control that makes an asset unreachable and invisible to everyone who lacks an explicit, verified reason to connect. A compromised or malicious party finds no address to attack in the first place. While the CVE stays open on the report, the attacker has nowhere to land.
Cloaking does not make you patch faster. It removes you from the race, and a race you are not running is one the five-day clock cannot win.
What the Series Covers
This is Part 1 of a six-part series on getting out of the patch race. Part 2 follows a single risk-acceptance waiver through its life and shows what deferral actually costs in audit credibility. Part 3 makes the technical case for how cloaking works, and why unreachable beats unpatched. Part 4 turns to the assets you can never patch at all, from end-of-life systems to the vulnerabilities no one has disclosed yet. Part 5 puts the hard-dollar cost of the patch treadmill in front of the CFO. Part 6 hands you a buyer’s checklist that resets the questions you ask your next security vendor.
If your vulnerability backlog has grown every quarter despite everything you have thrown at it, the rest of this series is written for you. Stay tuned.
Frequently Asked Questions
Why can’t we just patch faster to close the vulnerability backlog?
Patching faster shortens your remediation time by days, while the gap you are fighting is measured against a five-day median time-to-exploitation across tens of thousands of annual disclosures. Verizon’s 2025 DBIR found that even a focused set of high-priority edge vulnerabilities took a median of 32 days to remediate, and only 54% were fully closed. Faster patching narrows the loss. It does not turn it into a win.
What is the disclosure-to-exploitation window?
It is the time between a vulnerability becoming public and attackers exploiting it in the wild. The 2025 DBIR puts the average at five days. Because remediation timelines run in weeks to months, the window closes on the attacker’s schedule, not yours.
Does the surge in AI-generated CVEs mean the risk is exploding too?
Not directly. FIRST projects roughly 66,000 CVEs in 2026, yet notes that once the list is filtered for real-world risk using CISA KEV entries or high EPSS scores, the actionable patching burden has not materially increased. Volume and risk are different measures. The danger is speed on the vulnerabilities that do get weaponized, not the raw count.
What is vulnerability cloaking?
Vulnerability cloaking is a compensating control that removes an asset’s reachability, so an unpatched service presents no address an unauthorized party can find or connect to. The vulnerability still exists and still appears in scans, but there is no network path an attacker can use to exploit it.
Is cloaking a replacement for patching?
No. Patching remains the right long-term fix wherever a patch exists and can be applied. Cloaking changes the timeline pressure by protecting the asset during the days and weeks before a patch lands, and by covering the assets that will never receive one. Patching closes the flaw. Cloaking closes the exposure while you get there.
