The time between the disclosure of a computer vulnerability that can allow infection by a worm or virus and the release of an exploit that can attack that vulnerability has dropped from 6.4 days to 6.0 days. Meanwhile, the average time between the appearance of a vulnerability and the release of a patch is 54 days. Those statistics, which come from antivirus vendor Symantec’s most recent Internet Security Threat Report, are even more frightening when you consider that 1,862 new vulnerabilities were found in the first half of 2005.

symantec_threat1205.pdf