The numbers
Verizon’s 2026 Data Breach Investigations Report found that exploitation of vulnerabilities now makes up 31% of initial access vectors. It also found that only 26% of the vulnerabilities on CISA’s Known Exploited Vulnerabilities (KEV) list were fully remediated, down from 38% a year earlier.
The median time to fully remediate rose from 32 days to 43.
Attackers are moving faster than the queue.
What it means for a patch queue
A scanner export lists everything that could be wrong. A severity score says how bad it could be. Neither says whether anyone is using it.
If your queue follows a severity score alone, the fixes that matter wait their turn behind the ones that do not.
How exploitation evidence re-orders a list
Add one question to every finding: is there evidence that attackers are using this? Findings with evidence move up. Findings without it move down, and your team stops spending the week on them.
Morado ranks the findings from your scanners by that evidence, so your team fixes what can actually reach you first. [Brian: one sentence on how the ranking works, confirm]
What to do next
Export your latest scanner results and count how many of the top 20 are on the KEV list. Then see the same export ranked by evidence.
See it ranked in a demoSources: Verizon, 2026 Data Breach Investigations Report; CISA Known Exploited Vulnerabilities catalog.