The window between vulnerability disclosure and active exploitation continues to shrink. About one-third (28.3%) of exploited vulnerabilities are weaponized within 24 hours of disclosure, before most security teams have finished assessing the risk. Attackers are also exploiting more vulnerabilities.