Of all CVEs that eventually get exploited, what percentage remain unexploited at each point after disclosure?
How to read:each line tracks one year's cohort. A steeper drop means faster exploitation. When a line is near 50% by day 30, roughly half of eventually exploited CVEs were compromised in the first month.