Spikes in malicious activity precede new security flaws in 80% of cases

GreyNoise's analysis of telemetry from its Global Observation Grid shows that spikes in scanning and reconnaissance against enterprise edge devices frequently precede public disclosure of new CVEs (50% within three weeks, 80% within six weeks), with notable correlations for Ivanti, SonicWall, Palo Alto Networks, and Fortinet; the report recommends treating pre-disclosure scanning as an actionable early warning (monitoring and blocking origins) and notes Project Zero's change to announce discovered vulnerabilities earlier to reduce the patch gap.