2023 Threat Landscape Year in Review: If Everything Is Critical, Nothing Is

Qualys TRU’s 2023 threat landscape review analyzes 26,447 disclosed CVEs and focuses on 206 high-risk, weaponized vulnerabilities—many exploited in the wild and used by actors like CL0P/TA505 and LockBit—highlighting that less than 1% of vulnerabilities drive the highest risk, 25% of high-risk CVEs were exploited the same day as disclosure, the mean time-to-exploit is 44 days, and that network devices and web applications account for a large share of high-risk findings; the report recommends multi-sensor vulnerability management, prioritizing known-exploited CVEs and weaponized exploits, and rapid patching and inventory of public-facing services.