Monday morning. The vendor of your VPN gateway publishes an advisory: critical vulnerability, patch coming Wednesday. What the advisory does not say: the exploit has been circulating since Friday, and the first attackers used the weekend. Your next vulnerability scan is scheduled for the first Sunday of the month.
This is what 2026 looks like for most IT teams. Not because they do a bad job, but because the math no longer works: more vulnerabilities are published than ever, they are exploited faster than ever, and most companies still use tools built for a world where a monthly patch cycle was enough. This article uses real numbers to show why, what vulnerability management has to deliver today, and how we solved it with Goldoak Spectacles.
Vulnerability Management in 2026: The Numbers Behind the Headline
Vulnerability management means continuously finding security flaws in your own environment, rating them by risk, fixing them and proving the fix. That sounds like routine. The numbers show why it no longer is.
- 48,185 new CVEs in 2025, 20 percent more than in 2024. That is about 132 published vulnerabilities per day, one every 11 minutes, around the clock. Almost 40 percent of them are rated High or Critical.
- 90 exploited zero-days in 2025, up from 78 the year before. That only counts what Google Threat Intelligence was actually able to observe. Almost half targeted enterprise technology: firewalls, VPN gateways, security products, server software. Microsoft was the most affected vendor with 25 zero-days, followed by Google and Apple.
- 245 new entries in CISA's catalog of Known Exploited Vulnerabilities (KEV) in 2025, 30 percent more than in 2024. That is five new flaws per week that authorities know attackers are actively using.
- Vulnerabilities are the second most common way into a data breach. According to the Verizon 2025 Data Breach Investigations Report, 20 percent of all analysed breaches started with an exploited vulnerability, a 34 percent increase year over year. That puts vulnerabilities just behind stolen credentials (22 percent) and ahead of phishing (16 percent).
The last point deserves a second look. For years the message was that people are the weakest link. That is still true, but an unpatched flaw is now just as often the front door as a phishing email, and its share is growing faster.
The Patch Window Is Gone
The second development matters even more than sheer volume: the time between disclosure and exploitation.
Mandiant has measured for years how long it takes on average for a vulnerability to be exploited after it becomes known. In 2018 it was 63 days. In 2023, five days. For 2025, M-Trends 2026 puts the figure at minus seven days: on average, exploitation starts a week before the vendor even ships a patch.
VulnCheck arrives at the same picture with a different method: of the 884 vulnerabilities first exploited in 2025, 29 percent were already under attack on the day the CVE was published or earlier. In 2024 it was 24 percent.
What that means in practice was shown by the PHP2Shell case in October 2026: patch and first attacks on the same day, affecting every PHP application reachable from the internet. Anyone who waited for the next maintenance window had already lost.
For your business this means: a monthly scan plus Patch Tuesday covers the normal case. It does not cover the case that actually hits you. There, hours count.
What Traditional Vulnerability Management Cannot Do
Most tools we encounter at customers were built for a world with 5,000 CVEs a year. Today they fail in four places:
- The scan runs too rarely. A network scanner that runs monthly or weekly sees a flaw on average days after it was published. By then, according to the numbers above, it is often already being exploited. Laptops working from home are usually out of reach entirely.
- The list is too long. A mid-sized company with 300 devices quickly gets several thousand findings from one scan. Many tools answer with a spreadsheet sorted by CVSS score. Nobody works through 4,000 rows.
- The score does not know your context. CVSS 9.8 on a test server with no network access is less urgent than CVSS 7.5 on the gateway that faces the internet. A pure severity rating cannot tell the difference.
- Nobody owns it, nothing is verified. The finding sits in the report, but there is no person, no deadline and no check whether the update actually landed. At the next audit the search starts from scratch.
The result in many SMEs is the same: there is a tool, there is a report, and still nobody knows on Monday morning whether the VPN gateway is affected.
What Good Vulnerability Management Must Deliver Today
From the numbers and from our incident response work, five requirements follow:
- Inventory instead of scans. You need to know at any time which software runs in which version on which device. Then a new CVE can be checked against your estate immediately, without waiting for the next scan.
- Hours instead of weeks. Between the publication of a flaw and the moment you know whether it affects you, there must not be days.
- Context instead of severity. Internet exposure, the role of the system, listening services and whether the flaw is already being exploited must all feed into the priority.
- Actions instead of findings. An IT team does not work through CVEs, it works through tasks: "update Chrome on 14 devices", "apply gateway firmware". The tool has to bundle findings accordingly.
- Proof instead of hope. An action is only done when the flaw has demonstrably disappeared. And that must be provable later to management, insurers or auditors.
How Goldoak Spectacles Does It
We built the Patchmanager in Goldoak Spectacles along exactly these five points, as part of the platform that already runs on every device.
Inventory through the agent. The Spectacles agent reports the installed software and the exact operating system version of every device, whether it is a server in the data centre, a laptop at home or a notebook on the train. No network scan is needed, and devices without VPN are not a blind spot.
No scheduled scan, just continuous detection. In Spectacles there is no scan appointment that anyone has to plan, start or wait for. Our own vulnerability service watches the sources where a newly identified vulnerability is registered and published, around the clock, and merges them into one picture:
- CVE.org and the National Vulnerability Database (NVD), the central registries where every new flaw receives its CVE number, description and rating, including the fixed versions that vendors report themselves as CNAs.
- The EU Vulnerability Database (EUVD) run by ENISA, the European counterpart to the NVD, operated under NIS2 since 2025 and often adding its own ratings and guidance.
- CISA Known Exploited Vulnerabilities (KEV) and FIRST EPSS, so we know which flaws are actually being exploited and how likely an attack is within the next 30 days.
- Vendor data such as the Microsoft Security Response Center (MSRC) with the exact Windows builds and KB numbers per CVE, the Debian Security Tracker with backports, and the advisories of further vendors and distributions, which we keep adding.
As soon as an entry appears in any of these sources, it is automatically checked in the background against the inventory of all customers, with nobody having to trigger anything. If the flaw affects one of your systems, it shows up in the dashboard within a few hours of publication and your team gets a notification via Teams or email. Not at the next maintenance window, but the same day, usually before the flaw even makes it into the trade press.
Priority from access and impact. Every finding is rated not only by CVSS but by how reachable the system is (internet, listening ports, role) and what an attacker could do with it. This yields four levels: Immediate, Urgent, Normal, Low. Each level has a target deadline, 24 hours for Immediate.
Actions instead of finding lists. This is the part we have not seen in this form in any other tool: Spectacles automatically groups related findings into actions. 40 CVE rows for the same browser on three devices become one task with priority, deadline, affected systems and the risk reduction it brings. Actions can be assigned to a person, added to a weekly plan, or classified as accepted risk with a justification and approver, including an expiry date so nothing stays parked forever.
Proof through the next run. An action only counts as done when the agent no longer sees the flaw on all affected devices. Every rating, every status change and every decision lands in the audit trail and can be exported for auditors or insurers.
To be clear: Spectacles does not install the updates itself today. It tells your team within hours what is urgent where, in a form that can be worked through directly, and confirms when it is done. Applying the patches stays with your tools and processes.
Frequently Asked Questions About Vulnerability Management
What is vulnerability management? The ongoing process of finding security flaws in your own IT, prioritising them by risk, fixing them and proving the fix. The difference to a one-off vulnerability scan is the word "ongoing".
What is a zero-day? A vulnerability that attackers are already exploiting before the vendor provides a patch. The name comes from the vendor having had "zero days" to close it. According to Google, 90 such cases were observed in 2025.
Is Windows Update enough? For the operating system and Microsoft products, it is the foundation. But it sees neither third-party browsers, nor remote support software, firewall firmware or the PHP version on your web server. That is exactly where many of the exploited flaws of 2025 were.
How fast do I need to patch? For actively exploited flaws on internet-facing systems: within hours to at most a few days. For everything else, an orderly cycle is fine. The real question is therefore not "how fast" but "how do I know within hours that I am affected".
What if there is no patch? Restrict exposure, disconnect the service from the internet or shut it down, and monitor for exploitation attempts. In Spectacles this is documented as an action with justification and expiry date so the case is not forgotten.
Conclusion
A new vulnerability every 11 minutes, an exploited zero-day every few days, and exploitation starting on average before the patch. Against these numbers, no monthly scan and no spreadsheet will help. In 2026, vulnerability management has to mean: know at any time what is running, know within hours what is affected, and do the right thing first. That is exactly what we built the Patchmanager in Goldoak Spectacles for.
We are happy to show you what that looks like in your environment in a demo, with real CVEs and no sales pitch. If you first want to find out where your current patch process stands, we go through it together in a consulting session. The basics for getting started are in our 10 rules for better cybersecurity.