🤖 AI Summary
This study addresses the pervasive delay in patching critical vulnerabilities (CVSS ≥ 9.0) following disclosure, which significantly exacerbates organizational cybersecurity risks. Analyzing 12.8% of critical vulnerabilities among 245,456 CVEs reported between 2009 and 2024, this work presents the first integrated approach combining large-scale quantitative analysis with in-depth case studies. It reveals that remediation lags are systematically constrained by organizational processes, resource endowments, and system complexity, with pronounced disparities across industry sectors. Beyond elucidating the systemic mechanisms underlying vulnerability management delays, the research offers actionable recommendations for optimizing incident response. These findings provide empirical grounding and practical guidance to enhance the effectiveness of critical vulnerability governance.
📝 Abstract
Critical vulnerabilities with Common Vulnerability Scoring System scores of 9.0 or higher pose severe risks to organisations' information systems. Timely detection and remediation are essential to minimise economic and reputational damage from cyberattacks. This paper provides a thorough analysis of the identification and resolution timelines of such critical vulnerabilities. A mixed-methods approach is employed, integrating quantitative data from global vulnerability databases analysing 245,456 Common Vulnerabilities and Exposures records spanning from 2009 to 2024, of which 12.8 % were critical, with qualitative case studies of notable incidents. This methodical combination of quantitative and qualitative data sources enables the identification of patterns and delay factors in vulnerability management. The findings indicate significant delays in public disclosure and patch deployment, influenced by industry-specific factors, resource availability and organisational processes. The paper concludes with a series of actionable recommendations to improve the efficiency of vulnerability responses. Despite faster disclosure, the remediation gap for critical vulnerabilities remains a systemic risk, driven by organisational inertia and system complexity.