In Mandiant's analysis of 138 vulnerabilities exploited in the wild that were disclosed in 2023, the average time to exploit was five days, and 97 of them, about 70 percent, were exploited as zero-days. Waiting weeks to patch an exposed system is a bet that attackers will also wait.
The definitions
Mandiant, part of Google Cloud, defines the terms this way in its time to exploit analysis. Zero-days are vulnerabilities exploited before patches are made available, excluding end of life technologies. N-days are vulnerabilities first exploited after patches are available.
For our own plain explainer, see what is a zero-day vulnerability.
The 2023 numbers
The report states the following for vulnerabilities disclosed and exploited in 2023:
- 138 vulnerabilities were analyzed.
- The average time to exploit, or TTE, was five days, described as the largest drop thus far.
- That average excludes 15 outlier data points. Without removing the outliers, it grows from five to 47.
- 97 were zero-days and 41 were n-days, a ratio of roughly 70 to 30 in favor of zero-days.
The five day and 47 day figures both matter. The first shows how quick exploitation can be. The second shows how a few slow cases pull the average out, so do not read five days as a rule for every bug.
Caveats you should keep in mind
- This is a sample of vulnerabilities that were exploited and that Mandiant could track. Most vulnerabilities are never exploited. EPSS, for example, notes that most scores cluster near zero because most vulnerabilities are never exploited in the wild. See what EPSS measures.
- The figure is for one year. Later reports may differ, and a summary of a later report that we could not confirm from Mandiant's own text is therefore left out here.
- A short time to exploit for zero-days means exploitation began before any patch existed, so deadlines do not help for those. Mitigation does.
What this changes in practice
- Treat exploitation evidence as the main trigger for fast action, not severity alone.
- For internet exposed systems, plan for patching in days when a vulnerability is known to be exploited. NIST SP 800-40 Rev 4 describes an emergency patching scenario for that case, on an accelerated schedule.
- Prepare emergency mitigations for the zero-day case. See emergency mitigation when no patch exists yet.
- Keep an inventory so that finding affected systems takes minutes, not days.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard offers zero-day discovery, reachability analysis and SBOM and dependency scanning, so a team can see which projects contain an affected package and whether the vulnerable code is called. The free scan is at https://gold.safeguard.sh/scan.
Quick check
Does a five day average mean I have five days to patch?
No. It is an average over a sample after removing outliers, and many zero-days are exploited before any patch exists. Use exploitation evidence and exposure to set urgency.
Are n-days less dangerous than zero-days?
They are more numerous in general, but in Mandiant's 2023 sample zero-days were the majority of exploited cases. Both need a plan.
Sources
- Google Cloud, Mandiant time to exploit analysis for 2023
- FIRST EPSS FAQ
- NIST SP 800-40 Rev 4 full text (PDF)
Last reviewed: 19 October 2026.
