The Broken Physics of Remediation: The Data Behind the Shift to Autonomous Defense - Seguridad Mania.com - España y América Latina

Enterprise remediation still assumes that faster patching can outpace attackers. New research from the Qualys Threat Research Unit (TRU), based on more than one billion CISA KEV remediation records across 10,000 organizations from 2022–2025, shows the opposite: the average Time-to-Exploit has fallen to negative one day, meaning attackers weaponize vulnerabilities before patches exist. It has also been revealed that CISA KEV volume has surged 6.5x since 2022, and the backlog of critical vulnerabilities left open at Day 7 continues to compound. Teams are working harder but falling further behind because they are directing effort at theoretical exposure rather than confirmed risk. This session exposes structural problems defeating traditional risk management. We will explore the mathematical disparity between attacker and defender speeds and detail how to transition from a reactive, scan-and-report model to a proactive Risk Operations Center (ROC) approach driven by environment-adjusted exploitability. Key Takeaways: - Why MTTR is an incomplete risk metric, and how Average Window of Exposure (AWE) and Risk Mass better capture cumulative exposure. - Why less than 1% of disclosed CVEs drive confirmed, remotely exploitable risk, and how to operationalize that fact without missing critical threats. - How environment-adjusted exploitability and active confirmation reshape remediation priorities. - What it takes to move from scan-and-report to a risk operations center (ROC) model with embedded intelligence, confirmation testing, and autonomous remediation as a continuous loop.