Moody’s: exploited vulnerabilities take 87 days to patch

On 19 October the credit rating agency Moody’s published a report on the cyber risk of the organizations it rates: the median time to patch a known vulnerability already exploited by attackers is 87 days. Half of these flaws, in other words, are still open three months after disclosure. In the same days Rapid7, in its quarterly threat report, measured that the high-severity vulnerabilities attackers choose are exploited within three days on average. The gap between these two numbers is the starting point for reviewing your patching process.

What the Moody’s report says

According to Infosecurity Magazine, the report uses Bitsight Technologies data from February 2026, covering vulnerabilities disclosed over the previous two years. The key figures:

• 87 days median time to patch known exploited vulnerabilities;
• 107 days for vulnerabilities with no evidence of exploitation: when a flaw is not known to be used in attacks, the delay is even longer;
• according to LeMagIT, the analysis covers about 9,500 issuers rated by Moody’s, and 60% had at least one known exploited vulnerability left unpatched on their networks (a figure reported only by LeMagIT).

Moody’s itself warns that advances in AI offensive capabilities since February may have further reduced the time needed to exploit a flaw, and that remediation times may also have changed.

The report links the issue to credit risk. According to Moody’s, organizations with weak patching practices are the most exposed, especially if they run large digital networks and therefore a broader attack surface. Small and mid-sized companies, the analysts add, could become more economically viable targets as AI lowers the cost and effort of attacks. LeMagIT sums up the consequence: a weak security posture is likely to push up the cost of capital.

Meanwhile the volume keeps growing: Moody’s notes that Microsoft broke its own records for the number of security updates across three consecutive Patch Tuesdays.

Artificial intelligence and the exploitation window

According to the report, as covered by Infosecurity Magazine, AI agents are already able to exploit vulnerabilities and compromise systems within days. The document cites containment failures during developer testing at OpenAI and Anthropic; in OpenAI’s case it was an internal evaluation, not an attack. Moody’s points out that no threat-actor campaign of comparable scale has been publicly documented so far, but considers today’s barriers temporary: computing costs and restricted access to the most advanced models. The report also cites the estimate of the UK AI Security Institute: the cyber-capability gap between open-weight and frontier models has narrowed to four to seven months, from six to ten in the previous estimate.

Rapid7’s data: the window is measured in days

CSO Online reports the figures of Rapid7’s Quarterly Threat Landscape for the third quarter of 2026. They are not part of the Moody’s report, but they help to read it:

• 43 newly exploited vulnerabilities in the quarter, up 19% year on year;
• new high-severity CVEs (scores 7 to 10) rose by 133% and public proofs of concept by about 86%: exploitable flaws are growing much faster than the ones attackers actually choose;
• the high-severity vulnerabilities picked by attackers were exploited within three days on average, and 71% of the exploitation tracked landed within a week;
• nearly 80% of what was exploited could be reached remotely, with no authentication and no user interaction: the territory of MITRE ATT&CK technique T1190 (Exploit Public-Facing Application);
• on underground forums most posts referenced CVEs already in vendor advisories or in CISA’s KEV catalog within days of disclosure: commercial repackaging of known flaws rather than a market for new zero-days.

According to Rapid7, AI played an operational role in only about 8% of the attacks it tracked, in the tactical part (choosing the next technique, triaging targets), while the decision on whom to attack remained human.

Taken together, the data say that for one exploited flaw in two the fix arrives after almost three months, while attackers can be ready in a few days.

What it means for European and Italian companies

For entities in scope of NIS2 (in Italy, Legislative Decree 138/2024), vulnerability handling is one of the required security measures: months of waiting to fix flaws that are already exploited are hard to justify. The link Moody’s draws with creditworthiness adds an economic argument in discussions with management. According to Chris Cochran (SANS Institute), quoted by LeMagIT, the board needs a small set of indicators: exploitable exposed surface, patch latency, privileged access and tested recovery time.

What to do now

• Start from the profile attackers prefer: list the systems exposed to the Internet and reachable without authentication, and decide for each one how many days of exposure are acceptable (the recommendation reported by CSO Online).
• Prioritize vulnerabilities in CISA’s KEV catalog and those with a public exploit, with fix times measured in days for public-facing assets rather than monthly cycles. Rich Mogull (Cloud Security Alliance), quoted by LeMagIT, talks about “VulnOps”: vulnerability management as a continuous, DevOps-style process.
• Measure your own time to patch exploited vulnerabilities and compare it with the report’s 87 days.
• Contain what cannot be fixed: for legacy systems, segmentation, access restrictions, compensating controls and tested recovery.
• Reduce the surface: close unnecessary exposures and minimize privileges.
• Practice handling several incidents at once, with red team and tabletop exercises, as Rob Lee (SANS) suggests.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package, with their age, those already exploited by attackers highlighted, and the day-by-day trend: the data you need to measure your own time to patch. ARX Expose shows your attack surface from the outside, including known vulnerabilities on public services, and ARX Scout verifies which ports and services are actually exposed.

Last updated: 22 October 2026