Cite a patch or exploit statistic with four things attached: who measured it, what was measured, when, and how it was summarized. For example, "In one vendor's 2023 sample of 138 exploited vulnerabilities, average time-to-exploit was five days with outliers excluded." Without those parts, a number becomes a claim you cannot support.
The four part pattern
| Part | Example |
|---|---|
| Who | Mandiant, in an analysis of 2023 data |
| What | 138 vulnerabilities tracked as exploited in the wild |
| How summarized | Average time-to-exploit, excluding 15 outliers |
| Result | Five days, or 47 with outliers included |
All four details are from the Mandiant analysis (Mandiant).
Verbs that overclaim
- "Proves" for a single sample.
- "Always" and "never" for any distribution.
- "Industry standard" for a number from one vendor's data.
- "Attackers now exploit in X days" for an average of a sample.
Safer verbs are "reported", "found in a sample of", "measured" and "estimated".
Cite the original, and say what you read
If you read a press summary, say so, or better, find the report. Coverage of the 2025 Verizon DBIR reported that 54% of edge device vulnerabilities were fully remediated within a median of 32 days (Infosecurity Magazine). If you can only cite the summary, attribute it to the summary.
Preserve the uncertainty the authors state
Mandiant notes that undiscovered exploitation has likely occurred, so actual times are almost certainly earlier than the data suggests. Carrying that sentence forward is part of citing honestly. It does not weaken your point. It makes the point credible.
In security questionnaires and sales answers
Customers ask about patch speed. Do not answer with an industry figure. Answer with your own policy and measured results, and name the definition. For example, state the target window for known exploited flaws on internet facing systems, how you measure from patch release, and how exceptions are tracked. Do not describe certifications or audits you do not hold.
A quick template
- "[Source] reported [statistic] for [scope] in [period]."
- "This covers [population] and excludes [exclusions]."
- "It does not describe [what readers might assume]."
A before and after
Before: "Attackers exploit vulnerabilities in five days, so we must patch in five days."
After: "Mandiant's analysis of 138 vulnerabilities from 2023 found an average time-to-exploit of five days when 15 outliers were excluded. For flaws on internet facing systems with known exploitation, we treat the window as short and use a fast path."
The second version makes a smaller claim, yet it supports a real decision. It also survives a reader who follows the link and finds the footnote.
Check yourself before publishing
Read your sentence aloud and ask whether a careful reader who opens the source would agree with every word. If the answer is no, narrow the claim until it is yes.
Quick check
Do I have to name the sample size?
Yes where it is available. A figure from 138 items and one from 138,000 deserve different weight.
Can I round a number?
Round only if it does not change the meaning. Do not round a median of 32 days into "about a month" and then call it typical.
Sources
- Mandiant (Google Cloud), How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends
- Infosecurity Magazine, Verizon DBIR reveals jump in vulnerability exploitation
Last reviewed: 19 October 2026.
