Time to Exploit Plummets as N-Day Flaws Dominate

Flashpoint reports that time-to-exploit has fallen dramatically (from 745 days in 2020 to 44 days in 2025) as threat actors increasingly weaponize publicly disclosed 'n-day' vulnerabilities and researcher PoC code, enabling rapid mass exploitation using internet-wide scanning tools. The firm observed targeted zero-day and n-day attacks against security and perimeter products, including likely nation-state exploitation of Ivanti EPMM affecting government agencies, and warned that poor asset visibility and gaps from vulnerabilities without CVE IDs (and NVD processing delays) amplify risk to organizations.