Mandiant Puts Mean Time to Exploit at Negative Seven Days. Patch SLAs Haven't Caught Up.

Mandiant's M-Trends 2026, released March 23, puts a number on something practitioners have suspected for years: the patch window closes before it opens. The report puts the global "Mean Time to Exploit" at negative seven days for 2025, meaning attackers were exploiting vulnerabilities, on average, a week before vendors shipped fixes. In 2018, Mandiant's own baseline put that figure at a 63-day gap in the defender's favor. The reversal is now industry data, not a conference anecdote.

Jurgen Kutscher, VP of Mandiant Consulting, confirmed the release in a Google Cloud blog post built on what the company describes as 500,000 hours of frontline investigations conducted in 2025. Exploits remained the top initial infection vector for the sixth consecutive year, accounting for 32% of intrusions, according to the same post. Kutscher described a "clear divergence in adversary pacing," with some intrusion sets optimizing for immediate impact and others settling into what he called "extreme persistence" inside unmonitored edge devices.

What the negative number actually measures

The negative-seven-day figure is a mean across disclosed vulnerabilities that were actively exploited in 2025, not a constant applied to every CVE. Hive Security's April 14 analysis breaks the number down further, finding that 29% of exploited CVEs in 2025 were attacked on or before the day of public disclosure. Hive sells exploitation-intelligence feeds of the kind its report recommends, and no second source in Mandiant's own data confirms that exact figure; treat it as a vendor's read on the population dragging the mean below zero.

Mandiant's Executive Edition ties the acceleration to a separate shift in how access gets monetized. Global median dwell time rose to 14 days in 2025, up from 11 the year prior, which the report attributes to sophisticated espionage operations and DPRK IT worker schemes embedded inside victim organizations. Initial access brokers, the same report states, are now handing control to secondary actors in as little as 22 seconds — a handoff speed that sits oddly next to a two-week median dwell time measured by the same researchers.

Where exploitation concentrated

Help Net Security's March 24 coverage of the report names the three most exploited vulnerabilities of 2025: SAP NetWeaver (CVE-2025-31324), Oracle E-Business Suite (CVE-2025-61882), and Microsoft SharePoint (CVE-2025-53770). All three are enterprise platforms with internet-facing components and patch cycles measured in weeks.

The same coverage includes a split worth tracking separately: 52% of 2025 incidents were identified internally, while 14% were revealed by the adversaries themselves, typically through ransom notes. That is a larger share of self-identification than most programs assume, and it sits upstream of whatever a patch SLA does next.

CISA moved in June, not August

CISA issued Binding Operational Directive 26-04 on June 10, 2026, roughly eleven weeks after Mandiant's report came out. The directive creates a "Code Red" category requiring federal agencies to patch within three days when a vulnerability meets criteria that include active exploitation and automation potential. Nextgov/FCW's August 13 coverage of the new rules noted they were framed around Mandiant's finding that mean time to exploit had fallen to an estimated negative seven days. Three days is a fraction of the 15- or 30-day windows that have anchored most federal and commercial remediation SLAs for a decade.

Vendors agree on the fix; none of them is a practitioner

Three vendor reports published between April and October converge on the same prescription, each from a company selling a product adjacent to it. Hive Security's April 14 analysis pushes automated exploitation-intelligence feeds to replace manual triage backlogs, the category Hive operates in. Bitsight's September 3 readiness model and CIO.inc's October 2 summary both argue boards need metrics built around what Bitsight calls "externally observable" posture rather than patch percentage, which is the category Bitsight sells into. None of the three names a security team that has actually changed its SLA; they are vendors restating Mandiant's finding alongside their own category.

What the data doesn't settle

Mandiant's report does not break the negative-seven-day figure out by sector, so claims about which industries face the most pre-patch exploitation rest on the three named CVEs — SAP, Oracle, Microsoft — rather than a sector-level average. None of the sourced coverage specifies what fraction of the 32% exploit-vector share involved vulnerabilities disclosed after exploitation began versus before, beyond Hive's unverified 29% figure. The three-day Code Red threshold in BOD 26-04 is the one concrete benchmark published against the negative-TTE finding; commercial programs comparing their own SLAs have that number and little else to work from.

Links Verified at Time of Publish.

Sources

This article was reported from the following sources.

1. M-Trends 2026: Data, Insights, and Strategies From the Frontlines — Google Cloud Blog, 2026-03-23
2. M-Trends 2026 Executive Edition — Mandiant (Google Cloud), 2026-03-23
3. Microsoft's record Patch Tuesday shows why severity can't decide what gets patched first — VentureBeat, 2026-10-05
4. From CVE to RCE in Hours: The Collapse of the Exploitation Window — Hive Security, 2026-04-14
5. CISA just changed the rules. Is your vulnerability program ready? — Nextgov/FCW, 2026-08-13
6. M-Trends 2026 reveals threat landscape shaped by faster, coordinated, and industrialized cyberattacks — Help Net Security, 2026-03-24
7. M-Trends 2026 Report: Real-world Investigations and Actionable Defense Insights — CIO.inc, 2026-10-02
8. The Blast Radius Clock: Why After-the-Fact Detection Is Too Slow for AI Agents — AuthMind, 2026-10-08
9. Is Your Security Program Ready for AI-Powered Attackers? A 2026 Readiness Model — Bitsight, 2026-09-03