Qualys data shows vulnerability backlog widening sharply

Qualys has contributed vulnerability remediation analysis to Verizon's 2026 Data Breach Investigations Report, covering more than one billion anonymised records linked to CISA's Known Exploited Vulnerabilities catalogue.

Qualys data shows vulnerability backlog widening sharply. Qualys has contributed vulnerability remediation analysis to Verizon's 2026 Data Breach Investigations Report, covering more than one billion anonymised records linked to CISA's Known Exploited Vulnerabilities catalogue. The data spans four consecutive reporting cycles and examines how long vulnerability instances remain open after a flaw is added to the US government's list of known exploited vulnerabilities. Researchers describe it as a survival analysis of remediation, measuring exposure over time rather than relying on year-end closure figures. The figures show that KEV vulnerability instances increased 7.7-fold over four years, rising to 527.3 million from 68.7 million. Median detection-to-closure remained steady at nine days, suggesting remediation teams did not slow even as...