The Weaponization Gap: What 20 Million KEV Detections Reveal About Edge Remediation

The Weaponization Gap: What 20 Million KEV Detections Reveal About Edge Remediation

Speakers: Saeed Abbasi, Senior Manager of Security Research, Qualys Threat Research Unit (TRU)

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=xBrXAzWhmv0

Overview

This VulnCon talk, "The Weaponization Gap: What 20 Million KEV Detections Reveal About Edge Remediation," delivered by Saeed Abbasi, Senior Manager of Security Research at Qualys Threat Research Unit (TRU), delves into the critical and often overlooked challenges of securing edge devices. The presentation outlines an extensive four-year study, analyzing over 20 million known exploited vulnerabilities (KEVs) from Qualys’ global customer base of over 10,000 organizations. The core objective of the research was to understand the actual remediation timelines for these high-stakes vulnerabilities, particularly those affecting internet-facing infrastructure like firewalls, VPNs, and web application firewalls.

Abbasi highlights that edge devices serve as the "front door" to corporate networks, making them prime targets for threat actors and thus "crown jewels" for organizations. Despite their critical importance and the active exploitation of many vulnerabilities impacting them, remediation efforts often fall short, creating a significant "weaponization gap" where attackers leverage known weaknesses long before organizations can patch them. The talk reveals stark discrepancies in remediation speeds, the unexpected role of CISA's KEV list, and the profound impact of vendor engineering choices on security posture, offering crucial insights for defenders grappling with these persistent threats.

Background

▶ Watch: Introduction: The Weaponization Gap in Edge Remediation (0:00)

Edge devices are defined as assets operating at the perimeter of an organization's trusted network, often directly facing the internet. These include firewalls, VPNs, load balancers, web application firewalls (WAFs), and other network appliances. They are indispensable for controlling data flow, managing traffic, and enforcing security policies, making them highly attractive targets for adversaries. The research dataset comprised 18.6 million anonymized vulnerabilities detected across Qualys' customer base from 2022 to 2025, specifically focusing on 197 Common Vulnerabilities and Exposures (CVEs) added to CISA's Known Exploited Vulnerabilities (KEV) catalog during this period. The CISA KEV list, initiated in 2022, is a critical public resource that identifies vulnerabilities actively exploited in the wild, urging federal agencies and, by extension, all organizations to prioritize their remediation.

To ensure the integrity of the analysis, certain large-scale, older vulnerabilities were excluded. For instance, 13 million detections related to a 2017 Cisco CVE (CVE-2017-6742), which CISA added to its KEV list in 2022, were removed as they would have skewed the overall data due to their sheer volume and age. Similarly, approximately 1 million vulnerabilities associated with Fortinet FortiWeb were temporarily excluded from some analyses, though their unique characteristics later provided valuable insights. The study utilized Kaplan-Meier survival analysis, a statistical technique commonly used in medical research to estimate survival functions, but here adapted to track the "survival" of open vulnerabilities over time. Unlike simple average (mean) time to remediate, which can be heavily skewed by outliers and doesn't account for open cases, Kaplan-Meier curves provide a more accurate representation of how remediation progresses by including every single open vulnerability and showing the percentage of vulnerabilities remaining unpatched over successive time intervals. This methodology allowed the researchers to observe the true long-term remediation trends and identify critical bottlenecks.

Key Findings

▶ Watch: Vendor Engineering: Auto-Updates Dramatically Improve Patching Speed (8:00)

The research uncovered several critical findings regarding the remediation of KEVs on edge devices:

• Pervasive Slow Remediation: A primary finding was the alarmingly slow remediation rate for edge device KEVs. The Kaplan-Meier survival curves consistently showed that in multiple years, 60% or more of these critical vulnerabilities remained open by the end of the year. While there has been a noticeable improvement over time, with 83% open at 90 days in 2022 dropping to 57% in 2025, this rate is still far from ideal, especially for actively exploited vulnerabilities.
• The Power of Automation: A compelling data point emerged from analyzing Fortinet FortiWeb vulnerabilities. When these were included in the 2025 dataset, the remediation curve showed a dramatic drop in open vulnerabilities within the first 7 days. This anomaly was attributed to FortiWeb's auto-update capabilities, demonstrating that vendor engineering choices enabling automated patching are significantly more effective than any mandate or policy requiring manual intervention.
• Median vs. Average: The "Long Tail" Problem: The study emphasized the stark difference between median and average remediation times. While median fix rates improved significantly, showing nearly 9 times faster remediation in 2025 compared to previous years, the average remediation time remained almost double the median. This indicates a "long tail" phenomenon: many vulnerabilities are fixed quickly, but a substantial number are left unaddressed for extended periods, skewing the average and creating persistent risk. This highlights that simply telling IT to "patch faster" is insufficient; the underlying manual processes and approval bottlenecks must be addressed.
• KEV as Discovery, Not Prioritization: Counter-intuitively, for 85% of customers, the CISA KEV list acted as a discovery mechanism rather than a prioritization tool. This means organizations often became aware of a critical, actively exploited vulnerability only after it was added to the KEV list. For customers already aware of a KEV, the median fix time was 41 days. However, for those who discovered it via the KEV list, the median fix time skyrocketed to 319 days, underscoring a severe lack of asset visibility and pre-emptive vulnerability management.
• Vendor-Specific Bottlenecks: Remediation performance varied significantly across vendors. While some vendors like Palo Alto Networks and Sophos showed relatively faster median fix times (around 10 days), their average times were often 6 times longer, again pointing to a long tail. For others like Juniper and Cisco, the median and average times were both higher, with survival curves exhibiting distinct "cliffs" corresponding to maintenance windows. This indicates that inherent complexities like manual firmware upgrades or reboots, rather than organizational will, often dictate slow remediation for these platforms. For example, some Juniper vulnerabilities required waiting 200+ days for a maintenance window. Citrix vulnerabilities were particularly problematic, with only 54% fixed by year-end.
• Fixes Are Permanent (Mostly): A positive finding was that edge device fixes are largely permanent. Only 1 in 1,000 remediated vulnerabilities reverted to a vulnerable state. This high return on investment (ROI) for patching efforts should be leveraged to advocate for improved policies and resources. However, even these rare relapses often occurred after 5-month intervals, again coinciding with maintenance windows.
• Forgotten Devices and Mitigation: After a full year, certain vendors' devices showed a high percentage of unpatched vulnerabilities, with Mikrotik and Citrix being notable examples, suggesting these assets are often "forgotten." This reality reinforces the growing industry focus on "mitigation first" strategies, acknowledging that not all vulnerabilities can be patched in a timely manner and requiring backup plans.
• The Weaponization Timeline: Analysis of 91 KEVs with known weaponization timelines revealed a critical "weaponization gap." Many vulnerabilities were weaponized prior to disclosure (negative time to exploit), meaning attackers had a head start. Even for those weaponized after disclosure, organizations frequently failed to keep pace, with remediation sometimes taking 400 days. An Ivanti example showed weaponization 25 days before disclosure, yet 61% of affected devices remained unpatched after 90 days post-disclosure.
• Prioritization is Key: Out of over 48,000 vulnerabilities disclosed in the last year, less than 1% were both weaponized and remotely accessible. This small, critical subset represents the true priority for immediate action. Further evidence from leaked Black Basta ransomware group chats showed that their 18 months of discussions focused on only 62 vulnerabilities, highlighting that attackers reuse known, hard-to-patch vulnerabilities rather than constantly burning new zero-days.

Technical Deep Dive

▶ Watch: CISA KEV as Discovery, Not Prioritization, for 85% of Orgs (15:00)

The research's methodological backbone was the Kaplan-Meier survival analysis, a powerful non-parametric statistic used to estimate the survival function from lifetime data. In this context, "survival" refers to the duration a vulnerability remains open or "unfixed." Unlike simpler metrics like mean or average time to remediate (MTTR), Kaplan-Meier offers several crucial advantages:

1. Inclusion of Censored Data: It accounts for "censored" observations, meaning vulnerabilities that are still open at the end of the study period or those where the observation ended before remediation. A simple average would either exclude these or inaccurately assign an arbitrary "fix" date, skewing results.
2. Visual Representation: The survival curve graphically depicts the probability of a vulnerability remaining open over time. A steep drop indicates rapid remediation, while a flat curve signifies slow progress.
3. No Distribution Assumption: It does not require assumptions about the underlying distribution of remediation times, making it robust for real-world, often non-normal, datasets.

The analogy used to explain this concept was imagining 100 people with flat tires, tracking how many fix them each day from day zero to day 100. The Kaplan-Meier curve would show the percentage of people who still have flat tires over time. This provides a more holistic view than just an average, which could be heavily influenced by a few very slow remediations or artificially inflated by ignoring ongoing issues.

The study's dataset was massive, comprising 18.6 million vulnerability detections across thousands of organizations. The focus was specifically on the 197 KEVs identified by CISA between 2022 and 2025. Data cleansing was a critical step:

• Cisco CVE-2017-6742: This older vulnerability, added to KEV in 2022, accounted for 13 million detections across 460,000 assets. Its removal was necessary to prevent it from dominating the overall statistics and obscuring trends for newer, more relevant KEVs.
• Fortinet FortiWeb: Approximately 1 million vulnerabilities related to FortiWeb were also initially removed from some aggregate analyses. This was due to their unique remediation profile (often automated patching), which, if included, would have significantly skewed the early remediation curves. However, this specific dataset later served as powerful evidence for the impact of automation.

A recurring theme was the distinction between median and average remediation times. The speaker used the "Elon Musk" analogy: if Elon Musk walks into a room, the average net worth of everyone in the room skyrockets, but the median net worth remains largely unchanged. Similarly, a few unpatched vulnerabilities lingering for hundreds of days (the "long tail") can drastically inflate the average remediation time, making an organization appear slower than it truly is for the majority of its assets. The median, representing the midpoint of all remediation times, provides a more realistic view of typical performance. The research showed that while median fix times were improving (e.g., 9x faster in 2025), the persistent gap between median and average underscored that organizations quickly fix some vulnerabilities but neglect others, leading to a prolonged exposure window.

The finding that CISA KEV acts as a discovery mechanism for 85% of customers is a critical technical insight. This implies a systemic failure in proactive vulnerability management and asset visibility. Organizations are not effectively scanning or cataloging their edge devices, leading to a delayed response when a vulnerability becomes publicly known and actively exploited. The dramatic difference in remediation time (41 days median for aware vs. 319 days for newly discovered) highlights that the immediate challenge is often not patching itself, but the preceding steps of asset identification, ownership assignment, and approval processes.

Finally, the analysis of weaponization timelines against remediation times revealed a severe exposure window. Many CVEs were weaponized before public disclosure ("negative time to exploit"), giving attackers an inherent advantage. Even when weaponization occurred post-disclosure, organizations often couldn't keep up. This means that by the time a patch is finally applied, the system may have been vulnerable and potentially exploited for a significant duration, reinforcing the need for defensive strategies that assume breach and focus on detection and response, not just prevention.

Demo / Proof of Concept

▶ Watch: Focus: Less Than 1% of Vulnerabilities Are Actively Weaponized (36:00)

While the talk did not feature a live, interactive demo in the traditional sense, Saeed Abbasi detailed a specific capability offered by Qualys called TrueConfirm that functions as a sophisticated proof of concept for vulnerability validation. TrueConfirm is designed to remotely exploit vulnerabilities in a safe and non-harmful manner, without requiring whitelisting, but with prior approval.

The core idea behind TrueConfirm is to move beyond mere vulnerability detection (i.e., "is this version vulnerable?") to actual exploit validation (i.e., "can this vulnerability actually be exploited in my environment, bypassing existing defenses?"). When TrueConfirm successfully exploits a vulnerability, it confirms several critical points:

• The asset is indeed vulnerable.
• The vulnerability is remotely accessible.
• Existing defensive layers, such as firewalls, intrusion prevention systems (IPS), intrusion detection systems (IDS), and web application firewalls (WAFs), have failed to block the exploitation attempt.

This capability is particularly relevant to the talk's findings, as it addresses the need for organizations to understand their true exposure. It helps validate whether mitigations are effective or if the "weaponization gap" truly exists for a given vulnerability in their specific environment. By simulating real-world attacks in a controlled manner, TrueConfirm provides undeniable evidence of exploitable weaknesses, compelling organizations to prioritize and remediate effectively, or to bolster their defensive layers where patching is delayed.

Defensive Implications

▶ Watch: Q&A: Growing Awareness of KEV List Improves Remediation (47:00)

The research provides a clear mandate for organizations to fundamentally rethink their approach to edge device security. The following defensive implications are paramount:

1. Prioritize CISA KEVs Aggressively: The less than 1% of vulnerabilities that are both weaponized and remotely accessible (including all CISA KEVs) must be treated with extreme urgency. Organizations should implement policies that mandate immediate investigation and remediation for these vulnerabilities, recognizing that attackers are actively leveraging them.
2. Achieve Comprehensive Asset Visibility: The finding that CISA KEVs act as a discovery mechanism for 85% of customers highlights a dire lack of visibility. Organizations must invest in robust asset inventory solutions that continuously discover and map all internal and external-facing edge devices. This inventory must be integrated with vulnerability management systems to ensure that every asset is scanned and monitored.
3. Streamline Remediation Workflows: The "long tail" phenomenon and the significant difference between median and average remediation times point to procedural bottlenecks. Organizations should implement pre-approval policies for patching critical edge devices and drastically reduce the time required for approvals and change management, which can currently take up to 9 months. IT teams can patch quickly if empowered to do so.
4. Embrace Automation and Vendor Support: Where possible, leverage vendor features like auto-update (as seen with FortiWeb) to reduce manual effort and accelerate patching. When selecting edge devices, consider the ease and automation capabilities of their patching processes.
5. Assume Breach and Layer Defenses: For weaponized vulnerabilities, especially those with negative time to exploit, organizations must operate under an "assume breach" mentality. This means:

• Conducting threat hunting to detect signs of post-exploitation.
• Implementing micro-segmentation and Zero Trust principles to limit blast radius.
• Ensuring centralized logging for all edge devices to aid in incident response.
• Deploying and properly configuring IPS/IDS and WAFs to mitigate threats that bypass patching.

1. Harden Edge Device Configurations: Beyond patching, adhere to best practices for securing edge devices:

• Restrict management access: Isolate web UIs and management interfaces behind firewalls or VPNs.
• Implement Multi-Factor Authentication (MFA): For all administrative access.
• Rotate certificates regularly.
• Disable unnecessary services and ports.
• Maintain the latest firmware versions consistently.

1. Demand Comprehensive VM Vendor Coverage: Organizations must ensure their vulnerability management vendor provides 99% coverage for all CISA KEVs, with ongoing support. A lack of coverage means blind spots, leaving organizations vulnerable to known, actively exploited threats.
2. Leverage Mitigation Strategies: Acknowledge that not every vulnerability can be patched immediately. Develop and implement robust mitigation plans as a fallback, utilizing security controls like IPS/IDS, WAFs, and network access controls to reduce immediate risk while awaiting full remediation.
3. Educate and Empower IT Teams: Recognize that IT teams are often willing to fix issues quickly, but are hampered by bureaucratic processes or complex vendor requirements (e.g., maintenance windows). Provide them with the tools, policies, and authority to act decisively on high-priority edge device vulnerabilities.

Key Takeaways

• Edge Device Remediation is Critically Slow: Many actively exploited vulnerabilities on edge devices remain unpatched for months or even a full year, creating a significant "weaponization gap."
• Automation is a Game Changer: Vendor-provided auto-update features dramatically accelerate patching, proving more effective than manual efforts or policy mandates.
• CISA KEV Primarily Drives Discovery, Not Just Prioritization: For many organizations, the CISA KEV list serves as the initial alert for critical vulnerabilities, exposing a widespread lack of proactive asset visibility and vulnerability scanning.
• Prioritize a Small, Critical List: Focus on the less than 1% of vulnerabilities that are both weaponized and remotely exploitable, as these are the primary targets for threat actors.
• Assume Breach for KEVs: For actively exploited edge vulnerabilities, organizations must assume compromise and implement layered defenses, threat hunting, and robust incident response plans, in addition to patching.
• Visibility and Streamlined Processes are Paramount: Effective edge device security hinges on comprehensive asset inventory, integrated vulnerability management, and rapid, pre-approved remediation workflows to overcome the "long tail" of neglected vulnerabilities.

About the Speaker(s)

Saeed Abbasi is a Senior Manager of Security Research at Qualys, leading their Threat Research Unit (TRU). His team is at the forefront of vulnerability research, specializing in identifying new zero-day vulnerabilities, developing detection mechanisms for newly disclosed threats, and conducting in-depth security research. The insights presented in this talk are a direct result of his team's extensive work, often in collaboration with Qualys' data science unit, specifically acknowledging the significant contributions of Sheryus Salvi from the data science team to this particular research. Abbasi's expertise spans vulnerability management, risk management, and threat intelligence, with a focus on translating complex data into actionable security strategies for organizations worldwide.