That is the average time-to-exploit now. Negative.
Exploitation starts, on average, a week before disclosure — the patch window defenders plan around no longer exists. What remains is the window you control: how fast a stolen key gets used, and how much it can burn before you notice. This page tracks the verified incidents and lets you measure your own window.
Average time-to-exploit across tracked vulnerabilities — Google M-Trends 2026, analyzed by Qualys over CISA KEV data.
Of 52 tracked weaponized vulnerabilities were remediated slower than they were exploited (Qualys).
How long LiteLLM's poisoned PyPI wheels were live on Oct 21, 2026 — stealing keys at import, the whole time.
The ledger — verified incidents
Only incidents with named sources and checkable facts. Dollar figures are the victims' own reported numbers. Updated as new incidents verify.
How wide is your window?
Three numbers decide what an incident costs you: how long until you can rotate a key, where copies of your keys live, and whether one key can spend your whole budget. Be honest — the exploit clock is.
Shrink the window — the LLMJACK family
You cannot patch faster than negative seven days. You can decide what a stolen key is worth and how fast you find out.
SHIELD
Finds leaked keys in your repos, logs and configs — and rates what each one can burn. Free scan, local-only.
FIND THE LEAKSHONEYKEY
Canary keys planted in your own assets. The moment a thief uses one, you get their IP and timestamp.
CATCH THE THIEFSPEND/FENCE
Per-tool spend fences with a hard-stop proxy — a leaked key burns one capped fence, not the account.
CAP THE DAMAGE72-HOUR AUDIT
A human runs all three across your stack in 72 hours: keys found, fenced and tripwired. $750 flat.
Book the audit