Moody's Report Shows Median 87-Day Lag in Patching Actively Exploited Flaws

Moody's Investors Service released a new analysis indicating that the median time organizations take to apply fixes for known, actively exploited software vulnerabilities is 87 days, roughly three months after the flaws become public.

The study focused on vulnerabilities that have already been weaponized by threat actors, distinguishing them from the broader pool of disclosed flaws that may never see real-world attacks. By concentrating on those that are actively leveraged, the report highlights the window of exposure that businesses face while waiting for remediation.

According to the findings, the clock starts when a vulnerability is publicly disclosed and known to be exploited in the wild. From that point, half of the affected entities manage to patch the issue within 87 days, while the other half take longer. The data set spans multiple industries and includes a range of software types, from operating systems to widely used applications.

These timelines are consistent with earlier research that has shown patch deployment often lags behind discovery, but the emphasis on exploited flaws underscores a heightened risk. In many cases, attackers prioritize the same vulnerabilities that security teams aim to fix, turning the delay into a tactical advantage for malicious actors.

Industry experts note that the three‑month average poses a significant challenge for risk management, especially for organizations that rely on legacy systems or have complex patching processes. Extended exposure periods can increase the likelihood of successful breaches, data loss, or operational disruption, reinforcing the need for faster response mechanisms.

Looking ahead, the report suggests that improving coordination between software vendors, security teams, and IT operations could shorten the remediation window. Automation of patch testing, clearer communication of exploit severity, and prioritization frameworks are among the strategies recommended to reduce the median time and limit the attack surface presented by unpatched, exploited vulnerabilities.