Two reports released on November 10 measure the same race from opposite sides. Lumen’s threat researchers watched how fast attackers move. Azul surveyed how fast defenders patch. Put together, the numbers show a gap that keeps widening.
The attacker side: Lumen
Lumen’s CISO Update to its 2026 Defender Threatscape Report comes from Black Lotus Labs, its research team, which sees about 99% of public IPv4 address space from Lumen’s internet backbone. Its first-half 2026 findings are blunt. In one case attackers began targeting a newly disclosed vulnerability within 24 hours, and more than 100 attack servers were involved within 72 hours.
Automation is the multiplier. Over three weeks Black Lotus Labs watched one campaign launch more than 65 million attacks against more than 10,000 Fortinet devices, using AI tools to automate the intrusions. Background noise has become constant: nearly 4,000 brute force attacks and exploit scanners per day on average. And criminal infrastructure recovers. Disrupted botnets rebuild at scale.
Lumen’s pitch for its own product is upstream visibility. It says it saw infrastructure tied to one exploitation campaign more than three weeks before the vulnerability was publicly identified, and that backbone data spots threats 3 to 21 days sooner than other feeds.
The defender side: Azul
Azul, which sells commercial Java support, commissioned Censuswide to survey 300 US security leaders in August for its 2026 AI Vulnerability Gap Report. Sixty-nine percent said attackers could build a working exploit within three days. Forty-four percent said their organisation needs four days or longer to patch a critical vulnerability across production.
The consequences are already showing. Fifty-five percent reported a confirmed incident and 53% a near miss attributable to slow patching, 85% combined. Azul argues the real figure is higher, because an incident can only be traced to a system the organisation knew it had. Unmanaged Java runtimes don’t show up in inventories.
Java is a sharp example of the problem. The October OpenJDK update disclosed 53 vulnerabilities, about seven times the two-year quarterly average. Many enterprises still run Java 6 and 7. And standard quarterly updates bundle security fixes with other changes that teams must regression-test, which slows deployment. Azul, naturally, sells security-only updates as the fix, so the survey is also a sales document. The direction of the numbers is consistent with Lumen’s independent observations, though.
What it means
When exploitation takes a day and patching takes four or more, the window between them is where breaches happen. Our Cyber Threat Pressure gauge showed CISA adding exploited flaws to its catalogue at the fastest pace since 2022. Faster patching helps. Knowing every system you need to patch matters more.