Qualys warns patching surge is missing active exploits

Qualys has published research on what it describes as a remediation paradox in cybersecurity: patching activity is rising, but exposure to actively exploited vulnerabilities is getting worse.

Its analysis found that organisations are closing more vulnerabilities than in previous years, yet many are still failing to reduce risk where attackers are most active. It argues that security teams often prioritise work by volume and severity scores rather than evidence of real-world exploitation.

According to figures cited by Qualys, closures rose from 73 million in 2022 to 473 million in 2025. Over the same period, the share of critical vulnerabilities still open after seven days increased from 56% to 63%.

This suggests that greater effort has not translated into better coverage of the vulnerabilities most likely to be used in attacks. Qualys said fewer than 1% of vulnerabilities are actively exploited, suggesting many remediation programmes focus on issues attackers are unlikely to use.

Threat pressure

The research was published against a backdrop of increasing ransomware activity and rising breach costs. Qualys cited industry data showing ransomware now features in 48% of breaches, up from 44% a year earlier.

It also pointed to a projection that ransomware attacks could occur every two seconds by 2031. At the same time, AI-generated attacks rose 56% between March 2025 and February 2026, adding USD $1 million to breach costs, according to the figures it cited.

One of the starkest findings is the gap between exploitation and response times. Qualys said mean time to exploitation is now minus seven days, while mean time to remediate is plus 30 days.

That means exploitation or weaponisation often begins before defenders have a patch available or remediation under way. Half of the most critical actively exploited vulnerabilities over the past four years were weaponised before a patch existed, according to Qualys.

Rising costs

The financial impact of cyber incidents is also increasing. Qualys said every hour a breach remains active costs organisations about USD $1,100 in operational disruption, lost productivity and incident response overhead.

It cited global average breach costs of about USD $5 million per incident, up 12% from the previous year. In the United States, the average was about USD $11.5 million, more than twice the global figure. The Middle East, Benelux and Germany were also above the global benchmark.

These figures add to the pressure on security leaders, who must decide how to allocate limited staff and budget. Qualys argues that trying to fix everything can create large backlogs, repeated ticket reassignments and slower action on the most urgent threats.

Manual limits

Qualys said manual remediation processes failed to keep pace with attackers 88% of the time across the most critical actively exploited vulnerabilities over the past four years. The finding points to a structural problem in how many organisations manage patching and risk, particularly when tasks move between security and IT teams without clear ownership or asset context.

The analysis said friction often starts before a fix is applied. Tickets may be created without enough information on ownership or urgency, leading to validation steps, reassignment and delays before action is taken.

By contrast, organisations that operationalised their remediation pipeline performed better, according to Qualys. It said 15% of organisations in its research patched vulnerabilities before they were added to the Known Exploited Vulnerabilities list.

The company argues that this supports a more targeted approach based on active exploitation, evidence and business impact. It also said that using asset context and risk intelligence before creating a ticket cuts mean time to remediate by 30% and improves response times by 40%.

Lisa Bilawski, from Qualys' Risk Operations Centre team, wrote that organisations need to move away from a broad "fix everything" model and focus instead on vulnerabilities that present the greatest operational risk. She said the key questions for security teams should be whether a vulnerability is being actively exploited, what evidence exists, which assets are exposed and what can be automated.