Analysis of one billion CISA KEV remediation records exposes limits of human-scale security

Qualys Threat Research Unit analysis of over one billion CISA KEV remediation records finds Time-to-Exploit has collapsed to negative seven days and the percentage of critical vulnerabilities still open at Day 7 rose from 56% to 63%. Of 52 tracked weaponized vulnerabilities, 88% were exploited faster than they were remediated—some before patches or disclosure (examples cited: Spring4Shell, Cisco IOS XE, Follina). The report argues the existing scan-and-report operational model hits a human-imposed ceiling (the "Manual Tax"), proposes new metrics (Risk Mass, Average Window of Exposure), and recommends adopting autonomous, closed-loop Risk Operations Centers to remove human latency from the remediation critical path.