Rapid7 Q3 analysis: high-severity flaws exploited within three days on average
Rapid7's Q3 threat analysis found high-severity vulnerabilities exploited within three days of disclosure on average, ransomware still dominant, and AI cited in only 8% of tracked incidents.
Rapid7's threat analysis for the third quarter found that high-severity vulnerabilities were exploited within an average of three days of disclosure, with 71% exploited during the first seven days. Most of those flaws, 79%, were classed by Rapid7 as "holy grail" bugs: remotely exploitable and requiring neither credentials nor local user involvement.
Ransomware remained the dominant threat. Business services, manufacturing and healthcare were the most targeted sectors. The US accounted for 60% of attacks, followed by Germany at 7%, Italy at 5% and Canada at 5%. The most active groups by claimed incidents were The Gentlemen and Qilin, with INC Ransom, DeadLock and Krybit behind them. Government ransomware victims rose 15% on the previous three months.
AI featured less than the hype suggests. Only 8% of tracked incidents cited AI as an operational component, and Rapid7 said humans still chose what to attack and why in every documented case. Douglas McKee, the firm's director of vulnerability intelligence, told SecurityWeek the data doesn't support the "wall-to-wall AI attackers" narrative. What is growing, the report says, is automation of the tactical middle of an attack chain.
Rapid7 tracked 15 nation-state groups and advised defenders to watch for unusual AI API usage from unexpected hosts and processes.
Sources
- High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7Primarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning