// WE PUBLISH WHAT WE LEARN

Research & Analysis

Original computation on public data. Experiments with reproducible setups. Novel findings when we earn them. Every piece is labeled for exactly what it is.

Analysis

6

MIN READ

Annual Pentests Would Have Missed 67% of 2025's Actively Exploited Vulnerabilities

We computed the disclosure-to-exploitation window for all 245 vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog in 2025. The median window is 26 days. Under an annual pentest schedule, an expected 67.5% would never be tested before exploitation - and quarterly testing still misses 54%.

READ THE FULL PIECE ->