Mandiant's analysis of 2023 reported an average time-to-exploit of five days, but that figure excludes 15 outliers. With those data points included, the same average rises to 47 days. The gap shows how much one analytical choice can move a headline statistic, and why you should quote the method with the number.
What the analysis measured
Mandiant analyzed 138 vulnerabilities disclosed in 2023 and tracked as exploited in the wild. Of these, 97 were exploited as zero-days, which means exploitation began before a patch was available (Mandiant). It defines time-to-exploit as the average time to exploit a vulnerability before or after a patch is released.
The reported averages over the years were 63 days for 2018 to 2019, 44 days for 2020 to the start of 2021, 32 days across 2021 and 2022, and 5 days in 2023.
The outlier effect
The five day figure excludes 15 data points, two n-days and 13 zero-days, that were identified as outliers by a standard deviation based test. Without removing them, the average grows from five to 47.
That is not a flaw in the analysis. Excluding outliers is a common and often justified step, and the authors disclosed it. The issue arises when the number travels without the footnote and becomes "attackers exploit in five days".
Other caveats stated by the authors
- Where disclosure dates are vague, such as "mid-July", they assume the latest plausible date.
- Undiscovered exploitation has likely occurred, so actual times are almost certainly earlier than the data suggests.
- The metric covers both zero-days, exploited before a patch exists, and n-days, exploited after one, so the sample mixes two different situations.
How to cite it
| Instead of | Write |
|---|---|
| Attackers exploit flaws in five days | In Mandiant's 2023 sample of 138 exploited vulnerabilities, the average time-to-exploit was five days after excluding outliers, and 47 days with them |
| Patch within five days | Treat exploited flaws on exposed systems as urgent, with the clock starting at disclosure |
What it means for patching
The practical takeaway is not a magic number. It is that for an exploited flaw on an exposed system, the window between disclosure and attack can be short, so priority tiers and a fast path for known exploited issues are worth having before you need them.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how new advisories surface and which ones would trigger your urgent path.
Median or average
An average is sensitive to extreme values, which is exactly why outliers matter here. A reader who wants a feel for the typical case would also want to see a median or a distribution, and the analysis is a good prompt to ask for one. When you build your own metrics from disclosure to fix, show a median and a high percentile together, so a few extreme items cannot dominate the story in either direction.
Quick check
Is it wrong to exclude outliers?
No, provided the exclusion and the effect are disclosed. Quote both versions when you cite the result.
Does a five day average mean I have five days?
No. It describes a sample of exploited flaws. Your own window depends on the flaw, your exposure and whether exploitation is already known.
Sources
Last reviewed: 19 October 2026.
