Dependence-aware modeling of the patching-versus-exploitation race for software vulnerabilities

For a disclosed software vulnerability, the fraction of deployed systems that remain exploitable is governed by a race between three random timelines: patch development, patch deployment, and exploit development. Lohn and Jackson (2022) combined empirically fitted marginal distributions for these timelines — a Weibull distribution for patch development, an exponential distribution for patch deployment, and an exponentially-capped power law for exploit development — under an explicit independence assumption, concluding that patch-deployment speed is the dominant lever for reducing exposure (a baseline exploitable fraction peaking near 41% about 55 days after disclosure). Whether realistic dependence among the three timelines — for example, vulnerability classes that are both faster to exploit and faster to patch, or ecosystem-level heterogeneity in deployment — materially changes these exploitable-fraction dynamics, and how interventions that accelerate patch deployment perform under such dependence, remains unresolved both empirically and theoretically. Resolving it is the objective.

Background

A software vulnerability is a defect that permits behavior the software's designers did not intend; once a vulnerability is publicly disclosed (tracked, for example, as a Common Vulnerabilities and Exposures (CVE) record), a race begins in which defenders try to develop and distribute a fix (a patch) while attackers try to develop and deploy an exploit. An exploit that exists before public disclosure is called a zero-day; this problem concerns the post-disclosure window. Empirical security-measurement studies have characterized each stage of this race separately. Li and Paxson (2017) fitted a Weibull distribution — a two-parameter survival distribution with a shape parameter $k$ and a scale parameter $\lambda$ — to the delay between disclosure and patch availability, estimating $k \approx 0.57$ and $\lambda \approx 18.2$ days, and noting that about 78% of patches are already developed before disclosure. Nappa et al. (2015) measured how patches propagate across systems that share vulnerable code, finding deployment delays well described by an exponential distribution with rate $\beta \approx 1/144$ per day (about half of vulnerable installations patched within roughly 100 days). Feutrall et al. (2018) fitted an exponentially-capped power law, $A t^{a} e^{-bt}$ (a growing power law damped by an exponential so it saturates below one), to the fraction of vulnerabilities with a publicly developed exploit over time, using the ExploitDB repository of public exploits; Ablon and Bogart (2017) found similar timelines for privately held exploits. Lohn and Jackson (2022) combined these ingredients into a single race model: because patch deployment can begin only after patch development, the total patch delay is the sum of the two delays, computed as the convolution of their distributions (the integral giving the distribution of a sum of independent random variables), and the exploitable fraction of systems at time $t$ after disclosure is the probability that a system is still unpatched multiplied by the probability that an exploit has been developed:

$$E(t) = \bigl(1 - F_{\text{patch}}(t)\bigr) \cdot F_{\text{exploit}}(t).$$

With the fitted parameters this curve peaks near 41% at about 55 days and decays to 8.5% after a year. Sweeping the parameters to represent technological advances, the authors concluded that advances in automated exploit development raise exposure far more than advances in automated patch development, and that partial speedups of patch deployment are the most impactful defensive lever. However, every stage is treated as statistically independent of the others. The authors flag this explicitly: it may be that vulnerabilities which are faster to exploit are also faster to patch, patch development timelines do not vary greatly by severity, and deployment timelines depend heavily on the system and organization — so the dependence structure, its empirical magnitude, and its consequences for the model's conclusions are unknown. Related empirical signals already suggest coupling exists: Arora, Nandkumar and Telang (2006) found that attack timing responds to disclosure and patch availability, and the VEST (Vulnerability Exploit Scoring and Timing) system (Chen et al. 2019) predicts exploit timing from vulnerability features — yet no study estimates the joint distribution of the three timelines.

Problem Statement

For vulnerabilities disclosed before a patch is available, Lohn and Jackson's race model computes the exploitable fraction of systems at time $t$ after disclosure as $E(t) = \bigl(1 - F_{\text{patch}}(t)\bigr) \cdot F_{\text{exploit}}(t)$, where the patch delay is the sum of a Weibull-distributed development delay and an exponentially-distributed deployment delay (taken as independent so their sum is a convolution), the exploit-development fraction follows an exponentially-capped power law $A t^{a} e^{-bt}$ (a power law damped by exponential decay), and all timelines are mutually independent. The open problem is to replace this independence assumption with an empirically estimated dependence structure and determine the consequences. Specifically: (1) estimate, from field data (e.g., vulnerability databases, exploit repositories such as ExploitDB, and patch-adoption telemetry), the joint distribution of the patch-development, patch-deployment, and exploit-development timelines — conditional on observable vulnerability and ecosystem covariates where the data support it — handling the censoring that arises because most patches are developed before disclosure and exploits are observed only for vulnerabilities that eventually receive them, and respecting that deployment operates at the system level while development operates at the vulnerability level; (2) recompute the exploitable-fraction dynamics under the estimated dependence, quantifying the magnitude and direction of the change relative to the independence baseline (peak height and timing, tail decay, area under the exposure curve); (3) determine whether the model's central conclusions survive — in particular that accelerating patch deployment, rather than patch development or exploit-side changes, is the dominant lever for reducing exposure — and how any shift in the dominant lever depends on the dependence structure; and (4) within this dependence-aware model, evaluate concrete interventions that accelerate patch deployment (e.g., automated update infrastructure, staged or risk-based rollouts) under realistic operational constraints such as systems that cannot be taken offline and organizations that delay updates for stability and compatibility reasons, quantifying their effect on the exploitable fraction. The overarching objective is a dependence-aware, empirically calibrated model of the post-disclosure exploitation window that identifies where remediation effort buys the largest reduction in exposure; items (1)–(4) are jointly in service of that single objective.

References

1. Andrew J. Lohn and Krystal Alex Jackson. Will AI Make Cyber Swords or Shields: A few mathematical models of technological progress. arXiv:2207.13825, DOI 10.48550/arXiv.2207.13825, https://arxiv.org/abs/2207.13825 (2022).
2. Frank Li and Vern Paxson. A Large-Scale Empirical Study of Security Patches. DOI 10.1145/3133956.3134072, https://doi.org/10.1145/3133956.3134072 (Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 2201–2215, 2017).
3. Antonio Nappa, Richard Johnson, Leyla Bilge, Juan Caballero, and Tudor Dumitras. The Attack of the Clones: A Study of the Impact of Shared Code on Vulnerability Patching. DOI 10.1109/SP.2015.48, https://doi.org/10.1109/SP.2015.48 (2015 IEEE Symposium on Security and Privacy, pp. 692–708, 2015).
4. Andrew Feutrill, Dinesha Ranathunga, Yuval Yarom, and Matthew Roughan. The Effect of Common Vulnerability Scoring System Metrics on Vulnerability Exploit Delay. DOI 10.1109/CANDAR.2018.00009, https://doi.org/10.1109/CANDAR.2018.00009 (2018 Sixth International Symposium on Computing and Networking, pp. 1–10, 2018).
5. Lillian Ablon and Andy Bogart. Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits. RAND Corporation, DOI 10.7249/RR1751, ISBN 9780833097613, https://doi.org/10.7249/RR1751 (2017).
6. Ashish Arora, Anand Nandkumar, and Rahul Telang. Does information security attack frequency increase with vulnerability disclosure? An empirical analysis. DOI 10.1007/s10796-006-9012-5, https://doi.org/10.1007/s10796-006-9012-5 (Information Systems Frontiers 8(5):350–362, 2006).
7. Haipeng Chen, Jing Liu, Rui Liu, Noseong Park, and V. S. Subrahmanian. VEST: A System for Vulnerability Exploit Scoring & Timing. DOI 10.24963/ijcai.2019/937, https://doi.org/10.24963/ijcai.2019/937 (Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, pp. 6503–6505, 2019).
8. Marcel Böhme and Brandon Falk. Fuzzing: on the exponential cost of vulnerability discovery. DOI 10.1145/3368089.3409729, https://doi.org/10.1145/3368089.3409729 (Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp. 713–724, 2020).
9. Thomas Maillart, Mingyi Zhao, Jens Grossklags, and John Chuang. Given enough eyeballs, all bugs are shallow? Revisiting Eric Raymond with bug bounty programs. DOI 10.1093/cybsec/tyx008, https://doi.org/10.1093/cybsec/tyx008 (Journal of Cybersecurity 3(2):81–90, 2017).
10. Mingyi Zhao and Peng Liu. Empirical Analysis and Modeling of Black-Box Mutational Fuzzing. DOI 10.1007/978-3-319-30806-7_11, https://doi.org/10.1007/978-3-319-30806-7_11 (Engineering Secure Software and Systems, Lecture Notes in Computer Science, pp. 173–189, 2016).
11. Richard Fang, Rohan Bindu, Akul Gupta, and Daniel Kang. LLM Agents can Autonomously Exploit One-day Vulnerabilities. arXiv:2404.08144, DOI 10.48550/arXiv.2404.08144, https://arxiv.org/abs/2404.08144 (2024).
12. Yuxuan Zhu, Antony Kellermann, Akul Gupta, Philip Li, Richard Fang, Rohan Bindu, and Daniel Kang. Teams of LLM Agents can Exploit Zero-Day Vulnerabilities. arXiv:2406.01637, DOI 10.48550/arXiv.2406.01637, https://arxiv.org/abs/2406.01637 (2024).
13. Andrew J. Lohn. Defending Against Intelligent Attackers at Large Scales. arXiv:2504.18577, DOI 10.48550/arXiv.2504.18577, https://arxiv.org/abs/2504.18577 (2025).
14. Andrew J. Lohn. The Impact of AI on the Cyber Offense-Defense Balance and the Character of Cyber Conflict. arXiv:2504.13371, DOI 10.48550/arXiv.2504.13371, https://arxiv.org/abs/2504.13371 (2025).
15. Benjamin Murphy and Twm Stone. Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations. arXiv:2508.15808, DOI 10.48550/arXiv.2508.15808, https://arxiv.org/abs/2508.15808 (2025).
16. Mohamamad Reza Faghani. When Discovery Outpaces Remediation: Modeling AI-Accelerated Vulnerability Discovery in Interconnected Systems. arXiv:2606.11022, DOI 10.48550/arXiv.2606.11022, https://arxiv.org/abs/2606.11022 (2026).
17. Adarsh Anand, Navneet Bhatt, and Omar H. Alhazmi. Software Vulnerability Discovery Process: Concepts and Applications. CRC Press / River Publishers, DOI 10.1201/9781003605690, ISBN 9788770046176, https://doi.org/10.1201/9781003605690 (2024).