Mythos and the Broken Vulnerability Response Model: Why You Need the Qualys Risk Operations Center (ROC)
Vulnerability response has long operated on a single premise: even if you start responding only after a vulnerability is disclosed, pushing remediation speed high enough lets you stay ahead of attackers. This is exactly why, over the past decade, the industry has focused on shortening Mean Time to Remediate (MTTR).But AI is shaking this premise. Qualys explains that as AI—like Anthropic's frontier model Mythos (Claude Mythos)—uncovers source-code vulnerabilities that humans have missed for years, the time to exploit has shrunk from weeks to hours. This threat framing around Mythos is Qualys's own campaign framing, but much of the underlying data behind it comes from clearly sourced facts.This article first looks at the data behind why vulnerability response has hit its limits with existing approaches, then examines how Qualys's proposed solution—the Risk Operations Center (ROC) and the engine that drives it, Enterprise TruRisk Management (ETM)—addresses this problem from an operational standpoint. ☑️ What's changed in vulnerability response right now Here's the core issue: attack speed has now outpaced the remediation speed humans can manage, and the problem is no longer remediation speed—it's the operating model itself. The model of scanning, issuing tickets, and manually remediating was designed for an era of low vulnerability volume and long exploit timelines. In today's environment, where volume has exploded and exploitation happens before disclosure, no matter how fast you remediate, you fall structurally behind.This diagnosis is based on the report "The Broken Physics of Remediation," published by the Qualys Threat Research Unit (TRU) as part of the Qualys-Verizon DBIR 2026 research partnership. The report tracks and analyzes over 1 billion CISA KEV remediation records across more than 10,000 organizations over four years (2021–2025). Unless otherwise noted, the figures below come from this report's analysis, with original sources indicated for each figure.▶ Read the full "The Broken Physics of Remediation" report here ☑️ What the data shows about the limits of remediation Exploitation happens before vulnerability disclosureThe average Time to Exploit (TTE) shrank to -1 day in 2024 and -7 days in 2025 (per GTIG's Mandiant M-Trends 2026). A negative value means attackers have already weaponized and exploited the vulnerability before it was disclosed. The disclosure date—when defenders begin responding—is no longer the starting line of the race; it's the point where they confirm they're already behind.The report backs this up with real cases. Of the 52 major vulnerabilities with complete exploit timelines available, exactly half were already weaponized before disclosure. A Windows Kernel privilege escalation vulnerability was being exploited 182 days before disclosure, and a WinRAR code execution vulnerability, 110 days before. Volume has exploded, yet response has gotten worseThe number of CISA KEV vulnerabilities processed increased 6.5x over four years—from roughly 73 million in 2022 to roughly 473 million in 2025. Yet the proportion of critical vulnerabilities still unremediated 7 days after disclosure worsened from 56% in 2022 to 63% in 2025. The report's diagnosis is that this is a structural limit that cannot be overcome by headcount, process, or executive attention alone.Notably, remediation speed itself hasn't slowed. According to the report's appendix analysis, the median time from detection to remediation completion stayed flat, and organizations closed more vulnerabilities in absolute terms than in any prior year. Yet the unremediated rate still worsened—because the volume to be processed grew faster than the system's processing capacity. The report's central argument is that the problem isn't speed, it's capacity. For weaponized vulnerabilities, defenders mostly loseComparing the 52 vulnerabilities mentioned above by exploitation timing versus remediation timing, 88% were remediated later than the attacker's exploitation. In other words, the more weaponized and genuinely dangerous a vulnerability is, the more the structure favors defenders losing. Exposure lingers long after remediationThe limits of existing metrics show up clearly in the case of the WinRAR code execution vulnerability (CVE-2023-38831). This vulnerability had been weaponized 110 days before disclosure, and after disclosure, it took organizations an average of 137 more days to complete remediation across their entire environment. The total exposure window—from weaponization to full remediation—was 247 days, over 8 months. Even a year after disclosure, about 15% of vulnerable systems remained unpatched. Because MTTR only measures response speed after disclosure, it captures less than half of this story.The survival curve across CISA KEV critical vulnerabilities overall shows the same pattern. At disclosure, 85% of vulnerable assets are unremediated; after 1 week, 63% remain; even at the average remediation point of about 21 days, 33% are still open; and after 90 days, about 12% remain. Early response looks like progress on a dashboard, but exposure in the long tail doesn't show up well in the metrics. What MTTR misses: Window of Exposure and Risk MassThe report proposes two concepts to complement MTTR.One is Average Window of Exposure (AWE). This measures the full window from the moment a vulnerability is weaponized to the moment remediation is complete across the entire environment. Rather than just looking at remediation speed, it reveals how long an organization was actually exposed.The other is Risk Mass: the number of vulnerable assets multiplied by each asset's days of exposure (exposure-days), representing how long and how widely a risk persisted. A vulnerability closed in a day and one left open for months are both counted the same under a traditional CVE count as "remediated," but Risk Mass treats them as distinctly different risks. The report's analysis of the Follina vulnerability (CVE-2022-30190) finds that about 80% of exposure-days were concentrated in the pre-disclosure blind period and the long tail after remediation, while the initial-response window captured on dashboards accounts for less than 20%. This means what dashboards measure and actual exposure diverge.This divergence also shows up by asset type. The report calls the gap between the fast-remediating top performers and the slow bottom tier the "Manual Tax," noting that lower-tier assets—forgotten servers, remote endpoints, shadow IT—take 4 to 5 times longer than top-tier assets. Infrastructure and backbone systems tend to stretch remediation to months due to change windows and downtime constraints, making them where long-tail exposure piles up most thickly. ☑️ From prioritization to confirmation Here's an important shift. Prioritization is a task the industry has largely already achieved. In 2025, 48,172 vulnerabilities were disclosed, but only 357 of them—just 0.74%—were confirmed to be remotely exploitable, weaponized, and to have a working PoC. This ratio held mostly under 1% even as disclosed volume grew: 0.52% in 2022, 0.64% in 2023, 0.55% in 2024. The proportion of all disclosed CVEs ever listed in the CISA KEV catalog is also only about 0.48%. Narrowing the response target to under 1% using threat intelligence and risk-based prioritization has already become achievable.The report views the next challenge as not prioritization, but confirmation—the stage of deterministically verifying whether a high-priority vulnerability is actually exploitable right now, given an organization's specific compensating controls (WAF, firewall, EDR, network segmentation, etc.). The next challenge is closing the gap between what's theoretically dangerous and what's actually exploitable in your environment. If prioritization narrows the field, confirmation determines which of those remaining are truly dangerous. ☑️ Is your organization ready? Whether an organization is ready for autonomous response can be checked broadly across three axes: AI-speed detection, hyper-prioritization, and zero-day remediation. Below, we walk through each axis to check current operational status. Is AI-speed detection happening?Check whether detection runs continuously rather than on weekly or monthly scan cycles, whether all assets—on-prem, cloud, containers, and external attack surface—are covered, and whether new zero-day signatures are deployed quickly right after disclosure. If detection cycles are long or blind spots exist, response is already behind in an environment where exploitation happens before disclosure.Is hyper-prioritization happening?Check whether discovered items are filtered through active threat intelligence to identify the actually-weaponized few, whether asset criticality (internet exposure, core systems, data assets, etc.) is factored in, and whether exploitability is verified against your actual control environment rather than estimated from CVE scores alone. That last item is what we referred to above as confirmation.Is zero-day remediation happening?Check whether patchless remediation—such as mitigation or isolation—is possible when no patch exists, whether remediation is orchestrated across IT and security tools to eliminate manual ticket handoffs, and whether verified critical exposures can be remediated within a short timeframe.If the answer to any of these three axes is "not happening," that gap is a structural vulnerability in your current operating model. If you'd like a detailed checklist to assess your organization item by item, you can request one through the inquiry below. The approach that fills these three gaps into a single operating system is the Risk Operations Center (ROC). ☑️ How does the Risk Operations Center (ROC) solve this problem? ROC is an operating concept Qualys presents as an analog to the Security Operations Center (SOC). Where a SOC brings threat events together in one place for reactive response, ROC applies the same idea to proactive risk management—binding detection, prioritization, exploitability verification, and remediation into a single closed loop across the entire vulnerability response lifecycle.Underlying this is Continuous Threat Exposure Management (CTEM). CTEM is a framework established by Gartner—a methodology for reducing risk by consolidating scattered exposures. ROC implements this CTEM framework operationally, adding decision-making about whether a risk is worth remediating, financial risk quantification, and compliance/audit response. Enterprise TruRisk Management (ETM) is the engine that drives this ROC, and Qualys positions ETM as the industry's first cloud-based ROC platform.ETM (Enterprise TruRisk Management) takes the problems raised above and resolves them within a single closed loop. Starting from consolidating scattered risk in one place, let's look at how it addresses, in turn, the three data-backed limitations covered earlier. Bringing scattered risk into one placeFor a closed loop to function, scattered risk first needs to be consolidated in one place. ETM integrates data from asset management (CSAM), external attack surface management (EASM), and third-party tools to build a single asset inventory. It aggregates not just vulnerabilities but a range of asset types—OT/IoT devices, cloud environments, codebases, and user identities—and also ingests third-party signals from tools like Microsoft Defender, Wiz, Okta, and CrowdStrike. On top of this, it normalizes, deduplicates, and correlates 25+ threat intelligence feeds to add severity and exploitability context. The starting point is consolidating risk judgments that used to be scattered across different tools into a single standard. Recognizing pre-disclosure exploited vulnerabilities firstEarlier we noted that exploitation happens before vulnerability disclosure. If the disclosure point is already a starting line you're behind, response needs to begin ahead of the official signal. Continuous detection (VMDR) continuously discovers vulnerabilities across assets, while the threat intelligence layer, TruLens, adds real-time context. TruLens covers over 99% of the CISA KEV catalog and upgrades a vulnerability's severity an average of 40 days before a CVE is added to KEV. On top of this, the TruRisk score combines severity, exploitability, asset criticality, and business impact to determine remediation order. As a result, organizations can recognize risk ahead of the official threat catalog and establish which assets to address first. Unlike an approach that only starts responding at disclosure, this lets defenders get slightly ahead of the attacker's timeline. Responding only to the actually-exploitable few, not thousandsEarlier we noted that prioritization alone isn't enough—confirmation is needed. This is the stage of identifying which, among thousands or tens of thousands of critical vulnerabilities, is actually exploitable in your environment right now.TruConfirm plays this role. While a traditional scanner tells you "this could be vulnerable," TruConfirm proves "this is actually exploitable in this environment right now." It accesses assets from the perspective of an actual, non-whitelisted attacker, using a separate IP from the standard Qualys scanner. Verification uses modified, harmless payloads that don't damage systems—first confirming that the vulnerable service actually exists, and only then sending a payload, to reduce unnecessary network noise. If exploitation succeeds, it escalates the risk with deterministic evidence; if it fails, it records evidence of which control (WAF, firewall, EDR, etc.) blocked it. This turns scanner results into a judgment basis of "exploitable right now" versus "already blocked."What gets verified first is decided by Agent Val, the agentic AI layer. On top of a risk graph, it synthesizes business context, asset criticality, and threat intelligence (including KEV and active ransomware campaign signals) to determine verification order, and automatically runs the cycle of verify, mitigate, and re-verify. Once verification is complete, it presents remediation options tailored to the asset, OS, and environment, reducing the manual interpretation and coordination burden between teams. As a result, resources can be concentrated on the actually-exploitable few rather than thousands of theoretically dangerous items. This shifts the approach from persuading urgency through estimated severity scores to responding based on proven fact.Additionally, TruRisk's risk quantification (CRQ) uses asset tags and business entities to assess loss attribution and Value at Risk (VAR). Because it translates technical issues into the financial language of dollar amounts, it can serve as a basis for executive/board reporting and audit response. For organizations where regulatory compliance is important, this quantification and reporting carries substantial practical weight. Closing exposure gaps for assets with no patch or slow patching, then re-verifyingEarlier we noted that remediation is slow and exposure lingers long. Examples include the 247 days in the WinRAR case, or the long tail of infrastructure assets where patching takes months.TruRisk Eliminate handles this stage. It builds in four safeguards: an AI-based patch confidence score, staged rollout, rollback, and patchless mitigation for when no patch exists. When a patch doesn't exist, hasn't been verified, or carries operational risk, it follows guidance from the vendor, CISA, or the Qualys Threat Research Unit to change configurations and protect without a patch (TruRisk Mitigate), or proactively isolates at-risk assets before an incident rather than after (TruRisk Isolate). These actions integrate natively with ITSM tools like ServiceNow and JIRA, so they happen within existing IT operations processes without separate manual handoffs.After remediation, Agent Val and TruConfirm re-test the same exploit path to verify that exposure has actually been closed. This is a safeguard against incomplete remediation quietly returning to the backlog. As a result, exposure can be closed with mitigation while waiting for a patch, and it's confirmed whether remediation actually reduced risk. This lets organizations treat remediation not as "closed the ticket" but as "proved the exposure was closed."When this loop—discovery, confirmation, remediation, re-verification—runs as one, success metrics change too. According to Qualys, this process cuts verification noise by more than 90%, shortens remediation time for confirmed exploit targets by 70%, and reduces Average Window of Exposure (AWE) from 67 days to under 18 days. The direction of this approach is to shift the center of gravity in response from ticket closure counts to verified risk reduction. ☑️ Frequently Asked Questions How is the Risk Operations Center (ROC) different from traditional Vulnerability Management (VM)?The biggest difference is purpose. Where traditional vulnerability management focuses on processing individual vulnerabilities faster, ROC aims to transform the entire response process into an automated operating system. The difference is that it runs the entire flow from discovery to verification to remediation without manual handoffs.How are CTEM and ROC different?CTEM is the methodology, and ROC is the operating system that runs it. If CTEM is Gartner's framework for consolidating scattered exposure to reduce risk, ROC implements that methodology operationally, adding judgment about whether something is worth remediating, financial quantification, and actual remediation.Why isn't MTTR enough on its own?Because MTTR only measures response speed, not the start of exposure. It doesn't capture the period attackers have been exploiting a vulnerability before disclosure, or the accumulated risk from assets that remain exposed long after remediation is supposedly complete. The metrics that fill this blind spot are Average Window of Exposure (AWE) and Risk Mass.We're already prioritizing—why is confirmation needed separately?Because there's one question prioritization can't answer. Prioritization identifies theoretically dangerous vulnerabilities, but it doesn't tell you whether that vulnerability is actually exploitable right now under your environment's compensating controls. Confirmation verifies that, ensuring resources go only to genuine exposure rather than items already blocked by existing controls.How do you remediate a vulnerability with no patch?You respond with compensating controls that reduce exposure instead of patching—virtual patching, network-level isolation, host isolation—closing the exposure window until a patch becomes available. This kind of patchless mitigation matters especially for infrastructure assets where patching can take months. ☑️ Closing The problem of vulnerability response can't be solved with faster people or bigger teams. In an environment where exploitation happens before disclosure and volume is exploding, any approach that only pushes remediation speed hits a structural wall. Qualys's proposed Risk Operations Center (ROC) and ETM bind detection, intelligence, prioritization, confirmation, and autonomous remediation into a single closed loop—an approach aimed at shifting the center of gravity in response from ticket closure to verified risk reduction. The data and cases covered here are only part of the report; the full content, including survival curves and asset-type analysis, can be found in the Qualys report.This report's data is based on the U.S. CISA KEV, but the trend it describes—the collapse of exploit timelines and the limits of manual response—applies just as directly to organizations in Korea. This is especially true in environments like finance, manufacturing, and the public sector, where regulatory response and audit evidence matter and change-window constraints tend to delay patching—these are exactly where you need to review which assets to verify first and which remediations to automate. As Qualys's official partner in Korea, Cloud Networks can work alongside you on ROC/ETM adoption review, proof of concept (PoC), and implementation and operations tailored to your environment. If you need a readiness assessment for autonomous response or a review of your adoption direction, please contact Cloud Networks. ▶ Qualys Product Information [Sources: Qualys, "The Broken Physics of Remediation"; Qualys, "Enterprise TruRisk Management (ETM)"; Qualys, "ROC vs CTEM: What's the Difference?"; Qualys, "Introducing TruConfirm for Enterprise TruRisk Management: Automated Exposure Validation"; Qualys, "Meet Agent Val: Closing the Validation Gap in Exposure Management at Machine Speed with Agentic AI"; Qualys, "Handling the Vulnerability Surge in the Post-Mythos Era"; Google Threat Intelligence Group (GTIG), "Mandiant M-Trends 2026"]
July 15, 2026
