Moody's: Exploited Vulnerabilities Take 87 Days to Patch

A Moody's report found known exploited vulnerabilities take a median of 87 days to patch, leaving half unremediated after three months; flaws without exploitation evidence take 107 days. AI is accelerating vulnerability discovery and attacks, with the cyber-capability gap between open-weight and frontier models narrowing to four to seven months.

• Median patch time for exploited flaws is 87 days
• Flaws without exploitation evidence take 107 days
• Open vs frontier AI model gap narrowed to 4–7 months
• Report uses February 2026 data from Bitsight