Report by Cogent Security
The Detection Gap: How Exploits are Outpacing Scanners
Key Findings
Median detection lag from vulnerability disclosure was 0.1 days for Tenable, 2.9 days for Qualys, and 5.1 days for Rapid7.
AI-assisted exploit development compressed the average time from vulnerability disclosure to a working exploit from 125.3 days in January 2025 to 0.5 days by April 2026.
55.7% of critical CVEs never received scanner coverage at all.
62.0% of critical vulnerabilities with known exploits had a working exploit available before scanner detection signatures shipped.
54.0% of CVEs published since January 2025 had no detection signature from Tenable, Qualys, or Rapid7.
Exploits appeared before scanner detection for 62.5% of critical CVEs at Tenable, 64.5% at Qualys, and 73.5% at Rapid7.
44.3% of critical CVEs received scanner coverage.
83.2% of critical vulnerabilities either lacked scanner coverage entirely or had exploits appear before detection ships.