Exploited Vulnerabilities Take a Median of 87 Days to Patch — What This Means for UK Organisations

New research from Moody's, reported by Infosecurity Magazine, has found that known exploited vulnerabilities take a median of 87 days to be patched — roughly three months from the point at which active exploitation is publicly confirmed. The analysis examined vulnerabilities tracked in authoritative threat intelligence sources and found that extended remediation timelines are consistent across organisations of varying sizes and sectors. The finding is significant not because it reveals negligence, but because it quantifies the sustained window of exposure that organisations face even when the risk is well understood.

Why this matters for UK organisations

For UK businesses, the 87-day median reflects a real operational challenge. Patching production systems — particularly in environments with legacy infrastructure, complex dependencies or strict change management requirements — takes time. Testing updates, scheduling maintenance windows, coordinating with third-party vendors and managing the commercial impact of downtime all contribute to delays that are difficult to eliminate entirely. However, the research underlines that attackers are not waiting. Once a vulnerability is confirmed as exploited, threat actors — including ransomware groups and initial access brokers — actively scan for unpatched systems, often within hours of public disclosure.

The risk is compounded for organisations that treat all vulnerabilities equally, queuing critical exploited flaws alongside routine low-severity updates. Without a clear prioritisation framework that separates known exploited vulnerabilities from the broader patch backlog, the 87-day median is likely to remain unchanged regardless of team effort or investment.

What to review

UK security and IT teams should consider whether their current vulnerability management process distinguishes between known exploited vulnerabilities and those that are simply rated as high or critical by CVSS score alone. Exploited vulnerabilities — particularly those listed in authoritative sources such as the CISA Known Exploited Vulnerabilities catalogue — warrant a dedicated fast-track process with shorter remediation targets and clear escalation paths. Establishing your organisation's actual median patch time for exploited vulnerabilities, and reporting it as a security metric to leadership, is a practical first step toward improving performance. Where patching cannot be completed quickly, compensating controls such as network segmentation, enhanced monitoring or temporary feature restriction should be considered to reduce exposure during the remediation window.

Source: Infosecurity Magazine