The Gap Between Exposed and Exploited Is Closing

Three months of threat reporting. Ransomware quarterly numbers, edge-device advisories, supply-chain post-mortems, identity exposure data.

I went looking for the new technique. There isn't one.

The through-line is quieter and worse: the gap is closing. The gap between the moment something becomes reachable and the moment it is used against you. Between a CVE and its first exploit. Between a leaked cookie and a logged-in session. Between a dependency update and a compromised laptop.

Five signals from June to September.

1. The exploit now arrives before the CVE

The mean time to exploit a newly disclosed vulnerability is negative seven days. On average, the campaign is already running a week before the advisory is public. And 28.3% of exploited CVEs are weaponized within 24 hours of disclosure.

Read that again. "Patch on release" is not a strategy against a number that is negative. By the time you have a CVE ID to track, you are doing incident response, not vulnerability management.

Two things are rising at the same time: zero-day share is up, and so is n-day exploitation against organizations that never patched. Attackers are working both ends. The hardened consumer platforms are boring now - the interesting targets are VPN gateways, firewall appliances, identity systems, edge devices. Enterprise infrastructure. The stuff that sits on the perimeter and rarely gets a real pentest.

2. The network edge is the front door

The dominant initial-access vector for ransomware in mid-2026 was not phishing. It was edge appliances - Palo Alto, Fortinet, Citrix, Check Point VPNs and firewalls - chained through authentication bypasses and credential-harvesting to reach corporate networks without a valid login.

One representative flaw: exploited in the wild from mid-May, public proof-of-concept and CISA Known Exploited Vulnerabilities listing at the end of May, ransomware affiliates abusing it for VPN access by July.

CISA responded with a binding operational directive giving federal agencies a hard deadline to rip out unsupported edge devices, calling the threat "substantial and constant." That is not language regulators use lightly.

If your last real test of the perimeter was an annual pentest, that snapshot is already several exploitation campaigns old.

3. Ransomware stopped bothering to encrypt

Activity is up 17.5% quarter over quarter, across 91 active groups. One vendor logged a 48% year-over-year jump for a single month. Average incident cost: $5.08 million.

But the shape changed. More and more incidents involve no file encryption at all. The attacker exfiltrates the data and threatens to publish it. That is the whole attack.

This matters for defenders, because your last line - "we have backups" - does nothing against extortion by disclosure. And it matters for testing: if the damaging step is data being reachable and exfiltratable, then the question a pentest has to answer is not "can this host be encrypted" but "what can an attacker actually pull out of here, and does the fix stop it."

Some new families are also shipping post-quantum ciphers. Slower news, but the direction is set.

4. The software supply chain learned to self-replicate

In late 2025, npm saw the first self-propagating worm: malware that steals a maintainer's token, republishes trojanized versions of their packages, and uses the stolen credentials to jump to the next namespace. No human in the loop after patient zero.

2026 kept the pattern going. A widely used library compromised in May. In June, more than 30 packages under a single vendor's npm namespace trojanized with a payload that bypassed code review entirely. Roughly 99% of all open-source malware now lands on npm. One campaign published over 150,000 malicious packages in a couple of days.

The dangerous part is rarely the source code. It is the install behavior - a postinstall script, a lifecycle hook, a token sitting in an environment variable that a compromised dependency can read. Nobody reviews that. It runs before anyone looks.

5. Identity is the perimeter that already fell

Infostealers infected more than 11 million devices last year, feeding billions of stolen credentials, session cookies, and cloud tokens into criminal markets. Stolen identity data now shows up in 86% of breaches.

Session cookies are the important part. A stolen, still-valid cookie walks straight past the password and the MFA prompt, because it is proof you already logged in. And the targeting is moving up the value chain: API keys, service accounts, non-human identities, and password-manager master passwords - over a million of those recaptured in a single year, each one a whole vault.

What connects them

AI is on both sides now - accelerating vulnerability discovery, exploit development and reconnaissance for attackers; triage and adaptation for defenders. Prompt injection sits at the top of the OWASP list of LLM risks, with real findings against the AI features bolted onto Slack, Microsoft 365, Cursor, and GitHub tooling. Adaptive attacks bypass essentially every published defense. That is a separate article.

But underneath all five signals is the same structural fact: the thing that got exploited was visible and reachable before it was exploited. The edge device with a known CVE. The dependency with a suspicious hook. The cookie in a browser profile. The API key in a repo.

That is an exposure problem before it is an incident problem. And exposure is a state you can measure - continuously, not once a year.

The answers that no longer count:

• "We scanned last quarter."
• "The CVE is on the backlog."
• "The pentest said we were fine in March."

The question that actually matters now: right now, what is reachable, is it exploitable, and did the last fix hold.

Because the attackers already closed the gap. The only honest answer is to test on the same clock they attack on.

---

Sources: Brandefense - Ransomware Trends Q2 2026 · Brandefense - Vulnerability Exploitation Trends H1 2026 · Securelist - State of Ransomware 2026 · VulnCheck - 2026 State of Exploitation: Network Edge · Cybersecurity Dive - CISA edge-device directive · CybersecurityNews - Ransomware gangs attack Palo Alto, Fortinet, Citrix, Check Point VPNs · Sonatype - 2026 State of the Software Supply Chain · Unit 42 - The npm Threat Landscape · SpyCloud - 2026 Identity Exposure Report · Flashpoint - 2026 Guide to Infostealers · EC-Council University - Prompt Injection, the #1 AI Security Threat in 2026