Ninety-two days separate the 2018 median from the 2026 one, and the reported average of 11.5 days a year across eight years reproduces exactly that figure, none of it from defenders getting quicker [1][7][2]. In 2018 nothing was exploited more than a year after its patch shipped; by 2023 that described 47% of n-day exploitation [11].
The measurement swap is real. It does not carry the whole distance. NVD publishes a median of about 25 days after the vendor's own advisory [5], so a fix that has sat in the customer's update channel for three weeks still scores as a zero-day under a clock anchored to NVD [4]. That clock was measuring a database's backlog. Re-anchoring it moves 25 of the roughly 115 days between the retracted one-day median [1] and 116, call it a fifth [4]. The rest is population. Root Evidence's median runs over 3,769 exploitations confirmed in CISA's KEV merged with VulnCheck's [2][3], which is 1.48% of the 253,912 CVEs published in the same period [3]. The two statistics are computed over different sets, so relabelling one of them does not make them reconcile.
Exploitation still leads the initial-access tables while the window widens. Mandiant's M-Trends 2026 has it at 32% of initial infection vectors, first for a sixth consecutive year [12]; IBM X-Force counts 40% of incidents and a 44% rise in attacks starting at a public-facing application [13]; in Verizon's DBIR it is 20% of breaches, second to stolen credentials at 22% [14]. Grossman's explanation for the patience is mechanical: researchers publish faster than defenders remediate, so racing gains an attacker nothing when the same unpatched host will still be answering in month sixty [10].
What survives the correction is the queue. 2025 published roughly 44,800 CVEs against 17,800 in 2018, two and a half times the volume [17][7], while the exploited share has never crossed 2.2% in any year [17], which caps last year's real working set near 986 items [6]. The occupants are known in advance. The same fifteen vendors have topped the n-day table for nine straight years, Microsoft leading in eight of them [18], and one in three n-days lands in five flaw classes headed by OS command injection at 313 CVEs, then path traversal at 228 and SQL injection at 208 [19]. Those are the classes with mature public exploit tooling and broad scanner coverage, which is why they keep coming back [21].
Scoped to that list, remediation is a scheduling problem. Scoped to all 44,800 published CVEs [17], it is a staffing problem, and a four-month median gap between fix and first exploit is what the staffing problem looks like after eight years of compounding [6].
