Qualys analyzed more than a billion remediation records from 10,000+ organizations across four years of the CISA KEV catalog. Saeed Abbasi explains why patching faster is no longer enough. Join us at ROCon Americas, October 13-15 in Austin, Texas: https://www.qualys.com/rocon/2026/americas Try Qualys ETM free for 30 days: https://www.qualys.com/free-trial-new/enterprise-trurisk-management Recorded at Black Hat USA 2026, this session from the Qualys Threat Research Unit uses survival analysis instead of mean time to remediate, so vulnerabilities that never get fixed are counted too. The Qualys analysis was contributed to the 2026 Verizon DBIR. The result: teams are patching faster, but known exploited vulnerability instances grew from 68 million in 2022 to 527 million in 2025, and the median time to remediate has stopped improving since 2024. Verizon's DBIR shows vulnerability exploitation overtaking credential abuse as the top initial access vector for the first time in 19 years, at 31% of more than 22,000 breaches. Many vulnerabilities are also weaponized before a patch exists. The conclusion from the data is that manual remediation cannot keep up, and autonomous remediation is no longer optional. Read the full report, The Broken Physics of Remediation: https://blog.qualys.com/vulnerabilities-threat-research/2026/03/23/the-broken-physics-of-remediation Speaker: Saeed Abbasi, Head of Threat Research Unit (TRU) and Director of Product, Qualys Chapters: 0:00 Intro 0:28 The largest remediation study to date 1:48 Why survival analysis beats mean time to remediate 2:53 Verizon DBIR: exploitation overtakes credential abuse 4:20 Teams patch faster, but volume grows faster 5:32 How to read the survival curve 6:28 Year by year, 2022 to 2025 9:20 Median time to remediate has stalled 10:11 Attackers exploit before a patch exists 11:49 Weaponization versus patch timelines 14:33 You cannot patch your way out 15:29 Full report and ROCon invite #BlackHat2026 #CISAKEV #VulnerabilityManagement

 83      0