We analyzed 355,000 CVEs and CISA's entire KEV catalog. Patch Tuesday is a decoy: the real disclosure peak is Wednesday. A (tongue-in-cheek) guide to when not to take time off in vulnerability management.
Nearly 50,000 CVEs in 2025, 70,000 expected in 2026, yet less than 1% are actually exploited. Why CVSS and EPSS are no longer enough to decide what to patch.