The Broken Physics of Remediation

This research report analyzes remediation activity across one billion+ CISA KEV records (2022–2025) and concludes that organizations are structurally failing to remediate weaponized vulnerabilities quickly enough; it introduces new metrics (Average Window of Exposure, Risk Mass, Manual Tax), shows attackers often weaponize vulnerabilities before patches exist, and recommends combining embedded intelligence, active confirmation, and automated remediation to close the gap.