The Vulnpocalypse Report

Counting from the vendor advisory stretches the exploitation window to 116 days

Root Evidence rebuilt the exploitation clock on vendor advisory dates rather than NVD publication, and Jeremiah Grossman's team reads the resulting four-month median as a measure of inventory that stopped being maintained.