Verizon's 43-day median patch time, against a five-day weaponization clock

Mandiant's telemetry shows average time to exploit at roughly five days ^[5]. Set that against the 43-day patch median and the exposure window is 38 days ^[1]. The same median was 32 days in the prior cycle, an 11-day slip, about 34% ^[3][2]. KEV completion moved the same way: 12 points off, roughly a third of the previous rate ^[4][3].

Coverage is the second half of the problem. A manual engagement finds a bug only if the endpoint falls inside the sampled 5% to 10%, and the finding holds only until the next release ^[10]. The guide estimates the untested share of the estate at 90% ^[9].

The worked example is an IDOR in an authenticated account area. The attacker logs into an ordinary account, changes the account_id on a profile-update request, and finds the application never checks ownership; from there the chain runs ID enumeration to email rewrite to password reset to account takeover ^[16]. It has no CVE, and the input is well-formed ^[17]. A scanner matching responses against a CVE database misses it, and so does a DAST tool firing a fixed payload list, because the exploit needs a valid session and a multi-step sequence ^[18]. That bug class exposed 885 million mortgage and title records at First American Financial in 2019 ^[19].

The capability evidence is cited secondhand. XBOW's autonomous system topped HackerOne's US leaderboard in 2025 ^[11], and Fang et al. reported in 2024 that agents exploited 87% of one-day flaws unaided ^[12]. Cobalt's 4.5x figure for programmatic testing is presented as an effect of the testing model ^[8]. As described, that figure is an association. Teams testing on every build are also shipping on every build.

On price, the guide weighs one manual engagement at about $18,000 against IBM's $4.44M average breach cost for 2025 ^[14][15]. The ratio is roughly 247 to 1 ^[4]. The comparison lines up two prices and leaves out the probability of the breach, so it does not price risk.

The document behind the four-item bar is a free guide promoted on The Hacker News ^[22]. Its stated failure mode for the category is DAST with an LLM bolted on: the same fixed payload list underneath, nondeterministic coverage layered on top ^[20]. Work-item-enforced coverage is named as the first of three design criteria that separate a platform from a demo ^[21]. Cobalt's own remediation median, 39 days with a 25x gap between best and worst performers, comes from a different population than Verizon's 43 ^[6].