21.5 days to weaponization: the number that retires severity-score triage

Start with the arithmetic, because it is the part that does not depend on anyone's product. A window of more than two years narrowing to 21.5 days is roughly a 34-fold compression ^[2][1], and the resulting figure fits inside a single calendar month ^[2] - the same month that holds change approval, maintenance windows and regression testing. A backlog ordered by severity score assumes you eventually reach the bottom of it. At that average, the ordering no longer decides what waits. It decides what never gets touched.

The measurement worth arguing about is Wiz's own. It took high-priority alerts in enterprise environments and re-scored them against external reachability, toxic permission combinations and access to sensitive data ^[3], and across four major risk categories more than half of the initial findings did not survive ^[4]. Turned around, fewer than half of the alerts already escalated as high priority described something an attacker could use ^[3]. Wiz's framing of why is consistent with that: the severity of an intrusion is set by what an adversary can inherit and pivot to, not by the foothold ^[8].

The obvious caveat is that this is a vendor measuring the value of the capability it sells, on its own blog, with the full report behind a download ^[9]. The internal figures at least point the same way. Software remote code execution was 9% of observed findings ^[6], which leaves 91% sitting elsewhere ^[4], and Wiz says real-world exploitability favours exposed access pathways, credentials and secrets over software CVEs ^[11]. That is an awkward result for the way most programmes are staffed, because the queue that gets a weekly meeting is the CVE queue, and the data needed to rank by reachability - IAM relationships, network exposure, data classification - usually belongs to a different team.

Context filtering also does not empty the tray. Thirty per cent of observed environments already contain at least one externally exposed machine tied to a high-impact lateral movement path ^[5]. In roughly one environment in three, the filter returns a live finding rather than nothing, and that finding is the one that would have been buried in a severity-sorted list next to several hundred theoretical ones. Wiz's own stated failure mode is fatigue: equal urgency for every isolated flaw burns engineering cycles on risk that is not reachable ^[10].

Which leaves the gap in the post. Its most operationally useful assertion is that a small number of technologies accounts for most critical weaponized exploits ^[7] - and the supplied text names none of them and attaches no percentage. If weaponization averages 21.5 days ^[2], the planning question is which handful of technologies you would defend if you could only defend a handful. That list is the one part not printed.