A fix being released only means the vendor has a patched version. You are protected only once that version is running on your device. The gap between those two moments is where most real exposure lives, and it is often the longest part of the timeline.
The four gaps
- Discovery to fix. The vendor needs time to build and test a patch.
- Fix to release. The patch may wait for a scheduled release.
- Release to your device. Updates roll out in stages, or wait for you to approve.
- Release to inside your apps. If an app contains a flawed component, the app's maker has to rebuild with the fixed one first.
Gaps 3 and 4 are the ones most people forget. You can have the newest operating system and still run an app that bundles an old part.
What the evidence says
CISA notes that attackers often exploit known flaws and may keep targeting a vulnerability for months or years after a fix is available. A public fix tells attackers where the weakness was, so the days after a release can be the riskiest.
How the layers stack up
| Layer | Who closes the gap |
|---|---|
| Operating system | You, through system updates, or automatic updates |
| An app you installed | The app's maker releases, you install |
| A component inside that app | The app's maker must rebuild the app with the fixed component |
| A service you use online | The provider, usually without you doing anything |
For the third row you cannot act yourself. What you can do is choose vendors who ship updates regularly and tell you what changed.
How to shrink the gap
- Turn on automatic updates wherever offered, as CISA recommends.
- Check update screens for apps that do not update themselves.
- After a major flaw is in the news, check the vendor's page for the fixed version, then confirm your version number.
- Remove apps you do not use. Unused apps still carry flaws.
- Replace software that no longer gets updates. CISA advises retiring end-of-life software.
For teams that build software
Your customers depend on you for gap 4. When a component is found to be flawed, how fast can you tell which products contain it, and how fast can you ship a rebuild? That is your side of the gap.
Where Safeguard fits
Safeguard keeps an inventory of the components in each release through SBOMs and dependency scanning, and continuous monitoring flags new advisories against it. Reachability analysis shows whether your code actually calls the flawed part, and fix PRs can be opened for review. Autonomous remediation is off by default, with every category on Manual. Try the free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a new advisory is matched against components already in your inventory without a new scan.
Quick check
If my phone is up to date, are my apps safe?
Not necessarily. Apps update separately and may include their own components. Update apps too.
Can I speed up a vendor's fix?
Not directly. You can choose vendors with clear update histories and disclosure policies, and install fixes as soon as they arrive.
Sources
Last reviewed: 19 October 2026.
