Rapid7 warns of three-day gap before attacks exploit flaws

Attackers exploited high-severity vulnerabilities an average of three days after public disclosure in the third quarter, according to Rapid7. The cyber security company found that 71% of the exploitation it tracked took place within seven days.

The findings are part of its latest Quarterly Threat Landscape Report, which examined newly exploited vulnerabilities, ransomware activity, advanced persistent threat tracking and underground forum intelligence. Rapid7 tracked 43 newly exploited high- and critical-severity vulnerabilities during the quarter, down 7% from the previous quarter but 19% higher than the same period a year earlier.

The report argues that speed, rather than volume, is the immediate concern for defenders. Although the number of newly exploited vulnerabilities did not rise as quickly as overall disclosures, the gap between publication and exploitation narrowed sharply, leaving security teams less time to respond.

Rapid7 found that 80% of tracked exploitation occurred within 14 days of disclosure and 90% within 30 days. That pattern creates pressure for organisations that rely on fixed patching schedules or already face backlogs in vulnerability remediation.

Exposure window

The data also showed that many of the exploited flaws required little effort once systems were exposed. Of the 43 newly exploited high- and critical-severity vulnerabilities tracked in the quarter, 34, or 79%, required no authentication or user interaction.

That means internet-facing services with exploitable weaknesses can be reached directly, without stolen credentials or any need to persuade a user to click malicious content. The report says this increases the importance of knowing which systems are externally accessible and which are tied to active exploitation.

Rapid7 said a Common Vulnerability Scoring System rating alone does not provide enough information to decide what to fix first. Instead, it pointed to reachability, known exploitation and business criticality as more useful indicators when setting priorities.

AI use

The report also assessed how often artificial intelligence featured in observed threat activity. Rapid7 found that 92% of the threat reporting it tracked did not cite AI as an operational component, indicating that most documented activity still did not depend on AI for execution.

In the remaining 8% of cases, AI was used in a more operational way than simple content or code generation. According to the report, human operators still chose the target and objective in every documented case, but used AI assistance for technique selection, target assessment and adaptation when an attack step failed.

The research also described attempts by threat actors to split malicious goals across several AI sessions to avoid provider safeguards. Rapid7 said those findings have implications for detection, because defenders may need to focus more on behavioural monitoring and rapid adaptation than on known malware signatures or threat actor labels alone.

Access markets

Alongside vulnerability exploitation, the report highlighted continued criminal interest in selling entry points into compromised environments. Underground forum monitoring identified 41 posts advertising remote desktop protocol or broader network access during the quarter.

That suggests defenders need to consider more than software flaws alone when assessing risk. Attackers may gain direct entry through unpatched vulnerabilities, but they may also buy access already obtained by others.

The report places those findings in a broader view of the threat environment by combining vulnerability intelligence with ransomware, nation-state activity and dark web monitoring. According to Rapid7, the aim is to help security teams identify where attacker activity is concentrated and what should be addressed first.

For businesses, the findings add to pressure on patching and exposure management programmes. A three-day average exploitation window leaves little room for routine maintenance cycles, particularly when a flaw is present in an internet-facing system and can be exploited without authentication.

Rapid7 said security teams should begin by identifying externally accessible assets and the vulnerabilities affecting them. Teams should then prioritise known exploitation, unauthenticated access paths and systems that support critical business functions, while assessing compensating controls and detection coverage where immediate remediation is not possible.

The report's central finding is that exploitation is increasingly concentrated in the first days after disclosure, while most documented attacks are still directed by humans rather than AI.