Verizon DBIR Says Median Fix Time for Exploited Flaws Hits 43 Days

Verizon's 2026 Data Breach Investigations Report (DBIR) found that vulnerability exploitation now accounts for 31% of initial access in breaches—the top vector—while the median time to remediate CISA-confirmed Known Exploited Vulnerabilities (KEVs) has reached 43 days, exposing a structural gap as AI accelerates attackers' discovery and exploitation faster than defenders can keep up.