There is a common assumption baked into how security teams prioritize vulnerabilities: if a CVE has ever been exploited in the wild, it belongs on the high priority list permanently. Exploited once, exploited always. The assumption feels conservative and therefore safe. The data says otherwise.

This talk presents original research into the temporal structure of vulnerability re-exploitation and what it means for how organizations should build and evaluate prioritization models. The central finding is straightforward but consequential: if a vulnerability has had any exploitation activity observed, the probability of seeing it exploited again in the next 30 days is approximately 65%. That number sounds useful. The problem is that it is not flat. It decays in a predictable and measurable way. Once three weeks pass without observed exploitation activity, that probability drops substantially. Once several months pass, it approaches baseline. Past exploitation is not a guarantee of future exploitation, and treating it as one is costing teams real prioritization accuracy.

The assumption that exploitation flips a permanent switch is wrong in a second way. Re-exploitation events are not random and not independent, but they are bursty. Most vulnerabilities see concentrated activity in short windows. Many see exploitation that stops completely and never resumes. Only a small fraction are exploited consistently and widely over time. The industry mental model, where a CVE lands on a known-exploited list and stays dangerous indefinitely, maps very poorly onto what the data actually shows. We are making prioritization decisions based on a static snapshot of a dynamic phenomenon. Prioritizing from the KEV alone means you are likely missing older vulnerabilities that attackers still find viable and have not stopped using.

Attendees will leave with a working understanding of how re-exploitation risk decays over time, a framework for incorporating recency into their own prioritization models, and a clearer sense of why the timestamp on a threat signal matters as much as the signal itself. If your current approach cannot tell the difference between a vulnerability exploited last week and one that was exploited three years ago, this talk is for you.