Two datasets, one vendor list: edge risk is a procurement problem, not a CVE queue

Two collection methods that cannot see the same events produced the same vendor list. Exposure telemetry counts what is installed and reachable across thousands of customer containers; incident response casework counts what was found after the intrusion ^[1]. One is a census of an installed base, the other a sample of victims. The vendor names survive that difference in method. The CVE identifiers largely do not ^[2]. Read that way, an exploited-CVE list drawn from a single telemetry source is a sample, and the vendor names in it are the part that replicates.

The exposure ranking that comes out of it is not the one the coverage produced. Among customer environments running F5 products, 54% carry at least one exposed, actively exploited CVE ^[5]. Fortinet, the vendor most associated in the press with edge-device attacks, sits at 25% on the same container grain, inside a ten-point band with Check Point, Ivanti and Citrix ^[4]. That is a 29-point spread ^[16] between the vendor defenders have been pointed at and the one with the widest measured exposure. Both companies say two years of China-nexus headlines about Ivanti, Fortinet and Palo Alto Networks have described a narrower problem than their data shows ^[8].

The clocks are worse than the ranking. Citrix customers show a 461-day median time to patch ^[10]. Ivanti EPMM and Ivanti Connect Secure each surface a newly exploited CVE roughly every 8.5 to 13 months ^[12]. A 461-day window is about 15 months ^[18], longer than the interval at which those product lines reload, so an organisation remediating at the slow end of the observed range against a product line on that cadence is never once clean. It is always working the previous CVE. Priority labelling does not rescue it: the high-priority remediation penalty runs at roughly a fifth of baseline time to fix ^[17], and it runs in the wrong direction.

The honest weak spot is the edge-specific cut. The 52-CVE edge appliance subset moves the same way, but by 8 days, and it does not reach statistical significance ^[11]. That is the subset this argument most wants and the thinnest evidence in the paper. SentinelOne's version of the writeup points at the 2026 Verizon DBIR as outside corroboration that median patch times are rising ^[14].

Beyond patching, what the analysis asks for is feature-set minimization and endpoints run in protect mode to blunt lateral movement after initial access ^[13]. That is a concession to its own vendor-grain finding. If the durable variable is which appliance vendors sit in the estate, the controls worth funding are the ones that do not require knowing which CVE lands next.