No Patch Exists Yet: Who Owns the Pre-Disclosure Window?

The report documents that ~32.1% of exploited CVEs are attacked on or before publication, describes practical signals of pre-disclosure exploitation and a one-quarter operating model to close the ownership gap (name an owner, define entry triggers, build a focused product inventory, pre-authorise containment actions, and rehearse). It emphasizes controls that work when no patch exists — exposure reduction, product concentration awareness, compensating controls/virtual patching, detection based on post-exploitation techniques, and pre-agreed decision authority — and outlines Brandefense capabilities to help identify externally exposed assets and threat activity.