Zero-day exploitation prior to public disclosure is what happens when adversaries have a working exploit for a vulnerability before the rest of the world — including the vendor that wrote the code — knows the vulnerability exists. According to the CrowdStrike 2026 Global Threat Report, that category of exploitation grew 42% year over year in 2025.

The curve is bending. Fast.

The traditional cycle — scanner finds it, ticket opens, patch deploys — was built for a world where defenders had time. The 42% line says they have less of it every year, and the gap is widening.

Why this is happening

Three forces converged in 2025 to push that number up.

The speed. CrowdStrike clocked the average eCrime breakout time at 29 minutes — 65% faster than 2024. Adversaries no longer reverse-engineer patches; they discover, weaponize, and deploy in parallel with disclosure cycles, sometimes ahead of them entirely. The fastest observed breakout: 27 seconds.

The supply. A record 48,185 CVEs were published in 2025 (Edgescan 2026 Vulnerability Statistics Report). That volume creates a triage problem so severe that most organizations can't read the disclosures, let alone act on them in time.

The compression. Adversaries used generative AI to compress reconnaissance, payload generation, and evasion into hours — work that used to take weeks. The same tools developers use to ship faster, attackers use to break in faster. Vibe-coded vulnerabilities — flaws shipped by developers using AI assistants they didn't fully audit — are being exploited at the source, before any scanner sees them.

Bottom line: The trend isn't slowing. The pre-disclosure window keeps widening, and the patch cycle keeps the same length it always had.

What this means for defenders

If pre-disclosure zero-day exploitation is growing 42% a year, the question isn't whether your scanner stack will miss something — it's how often, and how much faster the gap is opening.

CVE-based detection presupposes a CVE. By definition, pre-disclosure exploits don't have one yet. That's not a flaw in any specific scanner. It's a structural limit of the model.

The resource-constrained CISOs we talk to keep saying the same thing: "We have the alerts. We don't have the answers." Their teams are drowning in scanner output for vulnerabilities that may or may not be exploitable in their environment, while the categories of exposure growing fastest — pre-disclosure zero-days, AI-introduced flaws, edge-device weaknesses — are the ones the scanner stack can't see at all.

CrowdStrike's data adds another twist for the vulnerabilities that do get disclosed: many were weaponized within two to six days of disclosure. Even when the patch is theoretically available, the window to apply it has compressed to single digits.

Bottom line: Whether the exploit lands before the CVE or just after, the patch cycle was built for a slower clock. The acceleration is the threat.

Why traditional vulnerability management can't close the gap

The traditional VM stack was built for a world that ran on a calendar — quarterly scans, monthly patch cycles, annual pentests. That world is gone.

Three things break it:

The volume problem. No human team can triage 48,000+ CVEs annually, plus the unknowns. Scanners don't help — they multiply the noise. A modern enterprise stack can produce hundreds of "critical" findings a week, and most aren't critical for that environment.

The verification problem. Even when you find a vulnerability, you don't know if it's actually exploitable where it lives. Most aren't — compensating controls, network segmentation, and configuration context all matter. But you can't tell which is which from the list alone, so you waste cycles on findings that don't matter and miss the ones that do.

The remediation problem. Even perfect prioritization doesn't fix anything. Someone still has to write the patch, test it, push it, verify it. In a 29-minute breakout window, that pipeline can't keep up.

Bottom line: Find-and-list is a 1990s strategy against a 2026 adversary. The threat model now requires Find, Prove, and Fix — continuously.

What works

The only defense fast enough for a 29-minute attacker is one that operates on the same clock. That means three things working together, continuously.

Find — agent-driven discovery across the full attack surface, not just what's on the scanner's list. That includes vibe-coded vulnerabilities introduced by AI-assisted developers, misconfigurations the scanner doesn't model, and shadow IT no scanner has indexed.

Prove — actual exploit validation in your environment. Not estimated risk scores. Not CVSS speculation. Working proof of concept, executed safely, that tells you exactly which findings can be weaponized against you and which cannot.

Fix — production-ready remediation generated and deployed with human-in-the-loop control. Pull request, infrastructure change, configuration update — whatever the surface requires. You stay in control of the deploy decision.

Bottom line: When pre-disclosure exploitation grows 42% a year, defense has to grow with it. That requires continuous Find, Prove, Fix — not a quarterly scan and a backlog.

Forty-two percent, year over year. That's not a forecast. It's the slope of a line that's already moving — and the slope is getting steeper.

Your security program either keeps pace with that curve, or it falls behind it. Every quarter, the gap widens.

Find. Prove. Fix.

— Agent Bounty