Source: Vulnerabilities and Threat Research – Qualys Security Blog
Author: Saeed Abbasi
URL: https://blog.qualys.com/vulnerabilities-threat-research/2026/05/19/inside-the-2026-verizon-dbir-what-one-billion-records-revealed-about-vulnerability-remediation
ONE SENTENCE SUMMARY:
Verizon’s 2026 DBIR shows remediation capacity hitting a human-speed limit as KEV workload explodes, demanding autonomous, machine-speed risk operations.
MAIN POINTS:
- Qualys contributed analysis of over one billion anonymized vulnerability remediation records to DBIR.
- DBIR uses survival analysis to track KEV remediation over time, not year-end snapshots.
- Remediation performance improved across 2022–2024 DBIR cycles at multiple curve milestones.
- The 2025 cycle reversed gains: 35% open at Day 28 versus 27% prior.
- Long-tail exposure hardened at 9%, equating to roughly 47 million lingering instances.
- Median detection-to-closure stayed at nine days, indicating defender effort didn’t decline.
- KEV-linked instances increased 7.7x in four years, from 68.7M to 527.3M.
- Day-28 open backlog surged from 31M to 184M instances, overwhelming built capacity.
- Top performers patch before KEV listing using risk prioritization and threat-context scoring.
- Proposed solution shifts to autonomous remediation via machine-speed “Risk Operations Center” pipelines.
TAKEAWAYS:
- Measuring vulnerability lifecycles with survival curves reveals systemic backlog dynamics obscured by snapshots.
- Scaling volume, not weaker execution, is driving defenders behind despite stable closure speed.
- Proactive remediation improved in output but fell in rate because workload grew faster.
- Human-gated remediation appears capped by a practical “speed of light” limit.
- Closing the structural gap requires architectural automation, not incremental staffing or tooling.