Mandiant's reported average time-to-exploit fell from 63 days for 2018 to 2019 to five days for 2023. Part of that may be real, and part may reflect a changing mix of zero-days and n-days, small samples and outlier handling. Read the trend as a direction to watch, not as a precise rate of decline.
The reported series
Mandiant's analysis gives these averages: 63 days for 2018 to 2019, 44 days for 2020 to the start of 2021, 32 days across 2021 and 2022, and five days in 2023. It calls the 2023 drop the largest so far (Mandiant).
Why a mix change can move an average
Time-to-exploit in this analysis covers exploitation before and after a patch. The ratio of n-days to zero-days was 38 to 62 across 2021 and 2022, and 39 to 61 across 2020 into part of 2021. In 2023 it shifted to 30 to 70. The authors noted that this was a notable departure from earlier years.
A simple illustration, using made up numbers: suppose zero-days count as near zero days and n-days average 40 days. A 60 percent zero-day mix gives an average of 16 days. Move to 70 percent and the average falls to 12, with no change in how fast anyone exploits any single type of flaw. The numbers here are only to show the mechanism.
Other reasons to read the trend with care
| Issue | Effect |
|---|---|
| Sample size | 138 vulnerabilities in 2023, so a few items shift the mean |
| Outlier removal | The 2023 average is five days with 15 outliers excluded and 47 without |
| Vague disclosure dates | The authors assume the latest plausible date |
| Undiscovered exploitation | Actual times are almost certainly earlier than observed |
| Definition | Tracked as exploited in the wild, so it excludes quiet exploitation |
Because these effects can pull in different directions, it is hard to say from the headline alone whether the true trend is steeper or flatter.
What defenders can take from it
The safe conclusion is modest: for flaws that do get exploited, a short window between disclosure and attack is common enough that a fast path for known exploited issues is justified. The more useful step is to stop relying on a trend and look at your own exposure: which of your internet facing components have a fix available, and which have no fix yet.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a new advisory appears and how quickly you could tell whether you are affected.
Quick check
Does a falling average mean attackers are faster?
It may, but it can also reflect a shift in how many zero-days are in the sample or how outliers are handled. Read the methodology.
What should I do with the trend?
Use it to justify a fast path for known exploited flaws, and measure your own time from disclosure to verified fix.
Safeguard supports this with continuous monitoring of your SBOM and dependencies, zero-day discovery, and policies and gates that you set yourself. The free scan at gold.safeguard.sh/scan is a quick way to see your own starting point.
Sources
Last reviewed: 19 October 2026.
