Attackers Are Now Faster Than the Patches Meant to Stop Them

What the data shows

Verizon’s 2026 Data Breach Investigations Report — built from over 22,000 confirmed breaches — found that exploiting unpatched software vulnerabilities was the initial access point in 31% of breaches, up sharply from 20% the year before. That’s the first time in the report’s history that this method has overtaken stolen credentials as the top way attackers get in.

The reason is speed. When a software flaw is publicly disclosed, both the fix and the details of the vulnerability become public at the same moment — and attackers move on that information fast. Mass scanning for newly disclosed vulnerabilities often begins within hours, and some vulnerabilities show evidence of active exploitation on or before the day they’re officially announced. Meanwhile, the median time organizations take to actually apply a fix for a known, actively-exploited flaw was 43 days in this year’s report. That gap — hours for attackers, weeks for defenders — is where most of these breaches happen.

Why this matters beyond big organizations

This trend is measured at the organizational level, but the underlying mechanic is identical on a personal phone, laptop, or router: a security update exists specifically to close a hole that’s already public knowledge. Every day you delay installing it is a day you’re running software with a known, documented weakness that anyone can look up.

The practical takeaway

Turn on automatic updates wherever it’s offered — operating system, browser, and any app that handles sensitive information (banking, email, messaging). The instinct to delay an update because it’s inconvenient in the moment is exactly backwards from a security standpoint: the update exists because the vulnerability is already known and actively being targeted, not as a precaution against some hypothetical future risk.

This data reflects organizational breaches, which don’t map one-to-one onto personal device risk — but the core dynamic (public disclosure triggers a race between attackers and defenders) applies just as directly to an individual’s unpatched phone or laptop as it does to a company’s server.