A look at what changed in the latest version of the Zero Day Clock, why CISA KEV alone is no longer enough, and what it means for CISOs, AppSec teams, and the AI-driven collapse of exploitation timeli
Focusing on exploitation timelines misses the shift toward behavioral intent. When the clock stops, the attacker is already inside the perimeter moving laterally through legitimate credentials or misconfigurations. This confirms that static vulnerability management is becoming a secondary concern compared to the actual operational choices made by an adversary. We see this when operators ignore known critical vulnerabilities to favor quieter, manual paths that bypass automated detection entirely. Security teams must prioritize identifying these intent-based patterns instead of chasing every high-severity score on the board. The real game is observing the path taken when the obvious doors remain locked.
The part I'd copy is the page listing what the instrument can't measure. Publishing that next to the numbers is rarer than it should be, and it's what makes the rest of it credible.
"Empty space is not safe space" is the line I'll be reusing. Honeypots saw 45% of network device KEV and nothing from Apple, and a blank cell on a dashboard reads like good news to everyone who didn't build it.
The stat that jumps out isn't the KEV count, it's that more than half of KEV entries haven't shown exploitation activity in three years and still fire the same alert as something under attack this morning. Almost no exposure management tool treats a KEV listing as a signal that decays, once a CVE flips on it stays on. Empirical's own clustering, persistent, frequent, occasional, rare, says those are different risk profiles, and flattening them into one static flag is how a three-year-dormant CVE ends up eating the same sprint capacity as this week's Fortinet bug. The diligence question for any prioritization vendor is whether their score is a function of last observed activity or just first observed activity.
Focusing on exploitation timelines misses the shift toward behavioral intent. When the clock stops, the attacker is already inside the perimeter moving laterally through legitimate credentials or misconfigurations. This confirms that static vulnerability management is becoming a secondary concern compared to the actual operational choices made by an adversary. We see this when operators ignore known critical vulnerabilities to favor quieter, manual paths that bypass automated detection entirely. Security teams must prioritize identifying these intent-based patterns instead of chasing every high-severity score on the board. The real game is observing the path taken when the obvious doors remain locked.
https://cyrilsimonnet.substack.com/p/three-critical-cves-were-available?utm_source=substor&utm_medium=substack&utm_campaign=comment
The part I'd copy is the page listing what the instrument can't measure. Publishing that next to the numbers is rarer than it should be, and it's what makes the rest of it credible.
"Empty space is not safe space" is the line I'll be reusing. Honeypots saw 45% of network device KEV and nothing from Apple, and a blank cell on a dashboard reads like good news to everyone who didn't build it.
The stat that jumps out isn't the KEV count, it's that more than half of KEV entries haven't shown exploitation activity in three years and still fire the same alert as something under attack this morning. Almost no exposure management tool treats a KEV listing as a signal that decays, once a CVE flips on it stays on. Empirical's own clustering, persistent, frequent, occasional, rare, says those are different risk profiles, and flattening them into one static flag is how a three-year-dormant CVE ends up eating the same sprint capacity as this week's Fortinet bug. The diligence question for any prioritization vendor is whether their score is a function of last observed activity or just first observed activity.
Hold the Makers Accountable
Build Security into the Platform
Stop Patching, Start Rebuilding
Eliminate the Root Cause
As I've been saying for thirty years...
Good luck getting corporate management to pull that off...