The Hacker in a Hoodie Index
Exhibit · CISA and the Verizon DBIR
Flagged urgent, patched slower
0
20
40
2024
2025
days
BOD 26-04 deadline for a listed KEV, 3 to 14 days
32 days
43 days
Median days to remediate a KEV (DBIR)
Deadline: CISA BOD 26-04, the accelerated KEV tier (a range). Actual: Verizon 2026 DBIR median days to full remediation, 2024 and 2025 data.
See the evidence and its sources →