How Quickly Do We Patch? A Global Reality Check (Spoiler: Not Fast Enough)

Independent measurement from three separate vantage points reaches the same conclusion: patch deployment lags exploitation, badly.

The global patching picture is slow and uneven. The SANS Internet Storm Center measured it from the outside and found vulnerable-system counts declining gradually and then stalling. Verizon measured it from breach data and found most known-exploited flaws still unremediated a month after patches were available. Both point the same direction.

Start with the SANS study, because it is the report this post is built on. The author pulled 30 months of Shodan data and tracked, for each vulnerability in the CISA KEV catalog, how many internet-facing systems remained exposed over time. For most flaws the exposed count dropped in a slow linear slide rather than a sharp cliff, and the slide flattened out with plenty of vulnerable systems still online. The honest caveat, which the author states plainly, is that Shodan can only fingerprint roughly 200 to 250 of the roughly 1,380 vulnerabilities in the KEV catalog, and it cannot always see a backported fix. Even with that limit, the shape of the curve is the story: patching is a slow bleed, not a fast close.

Verizon's 2025 Data Breach Investigations Report adds hard numbers from the defender's side. Exploitation of vulnerabilities was the initial access path in 20% of breaches, up 34% from the prior year's report. Only about 54% of edge-device and VPN Known Exploited Vulnerabilities were fully remediated across the year, and the median time to remediate them was 32 days. A month, for the flaws attackers are known to be using, on the internet-facing gear that guards the front door.

Google's threat-intelligence team measured the attacker's side of the same clock and found it collapsing. The median time-to-exploit for vulnerabilities fell to five days in the most recent full analysis, down from 32 days a couple of years earlier and 63 days before that. In their look at 112 flaws disclosed in 2024, the average time-to-exploit came out to negative one day, meaning exploitation was routinely happening before the patch was even released. Put the two sides together and the mismatch is stark: attackers now measure their response in days or hours, and the global defender average is still measured in weeks.

A patch you have not deployed protects nobody. The only figure that decides your safety is how many days your machine stays open after the fix goes public.

The exposure window is the stretch of time between a fix becoming public and your machine actually installing it. It is the number that matters because disclosure is symmetric: defenders and attackers read the same advisory at the same moment, and whoever moves faster wins your systems.

Here is the sequence, because it runs the same way almost every time. A vendor discloses a flaw and ships a patch. That advisory is public, so attackers get it too. They reverse-engineer the fix to work out exactly what it changed, build an exploit, and load it into automated scanners that sweep the entire public internet looking for machines that have not applied the update. You are not singled out. You are swept up by tooling that checks millions of addresses for the one door you left open.

Years ago this was survivable because the window was wide. An organization might have had months between disclosure and mass exploitation. That cushion is gone. When Google reports a five-day median time-to-exploit and Verizon reports a zero-day median from disclosure to mass exploitation for edge devices, a 32-day remediation median stops being "reasonably prompt" and becomes "four weeks late." The math is not close, and it does not care how busy the office manager was.

• Disclosure is public on day zero. The advisory that tells you to patch is the same advisory that tells an attacker what to build. There is no head start.
• Exploitation is automated, not personal. Scanning tools hit the whole internet. A 15-person firm in Cypress is as findable as a Fortune 500, and often easier to breach.
• Known-exploited flaws are the priority. The CISA KEV catalog exists because these vulnerabilities are confirmed in active use. A flaw on that list is not theoretical risk, it is a scanner already looking for you.

Not because owners are careless. Because patching is a full-time discipline handed to people who already have a full-time job.

Houston SMBs land on the slow side of the global patch curve because patching is nobody's dedicated job, on a mix of systems nobody has a complete inventory of. The failure is structural, and it is exactly the failure the SANS data captures at internet scale: machines that stay exposed long after a fix exists.

Walk into a typical 25-person firm in Katy or Sugar Land and you will not find a patch manager. You will find an office manager who also "handles the computers," or an owner resetting passwords between sales calls. Patching competes with payroll, client deadlines, and every fire louder than a security advisory nobody read. In 35 years doing this, the pattern barely changes: the intent is there, the time is not. That is how a business becomes one of the flat-lined systems in a global scan, still vulnerable months later.

The specific things that push small Houston businesses into the lag are predictable:

• No complete asset inventory. You cannot patch what you do not know you own. A laptop that went home, a server in a closet, a line-of-business app three versions behind, a firewall a prior vendor set up and never revisited. The unknown gear is where the exploit lands.
• Fear of breaking production. A bad patch can disrupt as much as the bug it fixes. An owner burned once becomes reluctant to apply anything, which is worse, because now the known-exploited flaws stay open by choice.
• Third-party software blind spots. Windows nags you to update. The PDF reader, browser plugins, accounting package, and remote-access tool often do not, and those are exactly what Verizon shows attackers probing on the edge.
• Remote and hybrid machines. A laptop that rarely touches the office network can go months without checking in for updates. Most Houston SMBs now run several.
• No verification step. Clicking "update" is not the same as confirming the patch installed on all 40 endpoints. Without a report, you are guessing, and the one machine you missed is the one the scanner finds.

This region gives the problem a real local edge. The Houston metro runs on lean, often family-run companies in construction, engineering, oil and gas services, CPA practices, and law firms, many growing faster than their back-office systems. That growth bolts on new devices and new software constantly, widening the patch surface at exactly the pace a small team cannot match. Add the Gulf Coast reality that energy-sector operators here carry older operational technology that vendors patch slowly or not at all, and you get a corridor of capable businesses sitting further out on the slow end of the global curve than their owners realize.

The economics run in the small business's favor here, which is not always true in security. A managed provider spreads the cost of patch tooling and the expertise to run it across many clients, so a Houston company with 30 employees gets enterprise-grade patch discipline for a predictable monthly fee. Set against the cost of one ransomware event that walked in through an unpatched remote-access tool, the comparison is not a close call.