Why patch cycles fail: Rapid7 Q3 2026 Threat Report

Human operators still select targets and dictate intent, while exploitation windows shrink to days, not weeks.

Security teams face a widening gap between vendor patch cycles and real-world exploitation. The new Rapid7 Quarterly Threat Landscape Report quantifies that gap: attackers weaponize high-severity vulnerabilities within an average of three days, and 71% of exploitation happens inside the first week. Softprom is the official distributor of Rapid7.

What was announced

Rapid7 (NASDAQ: RPD) released its Q3 2026 Quarterly Threat Landscape Report, drawing on managed detection and response operations, vulnerability intelligence, and underground monitoring. The report connects adversary behavior to the newly announced Rapid7 Intelligence service.

Despite industry warnings about autonomous AI attacks, AI appeared as an operational component in only 8% of tracked incidents. Human actors remain the primary drivers of modern threats.

Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which has not materialized. Agentic capabilities are advancing faster than any organization, attackers included, can rework its processes around them. Defenders need to move past reactive patching and start grounding their risk appetite in concrete days of exposure

Why this matters

For CISOs, CIOs and procurement leaders, the report reframes risk from static vulnerability counts to measurable days of exposure. Traditional monthly patching cycles cannot keep pace when 79% of exploited flaws require no authentication and no user interaction, giving adversaries direct remote access.

U.S. organizations recorded the largest ransomware activity, with 1,112 leak-site listings, roughly eight times Germany's total. Compromised access brokerage remains active: of 63 monitored underground posts, 41 advertised RDP or network access.

Technical details

• Average time-to-exploit: 3 days for high-severity vulnerabilities
• First-week exploitation: 71% of tracked cases
• Unauthenticated flaws: 79% require no authentication and no user interaction
• AI usage by attackers: 8% of tracked incidents
• Top ransomware groups: The Gentlemen (342), Qilin (339), INC Ransom (99)
• Persistent tactics: command and scripting interpreters, credential theft, remote-access exploitation
• Recommendation: behavioral detection and response over static group lists

FAQ

How fast are attackers exploiting new vulnerabilities?

On average within three days of disclosure, with 71% of exploitation occurring during the first week. This outpaces monthly patch cycles and requires continuous exposure management.

Is AI already driving most cyberattacks?

No. According to the Rapid7 Q3 2026 report, AI appears as an operational component in only 8% of tracked incidents. Human operators still select targets and set attack intent.

What does Rapid7 Intelligence provide?

Rapid7 Intelligence consolidates vulnerability research, incident response data and underground monitoring into a single view of adversary operations, helping defenders prioritize fixes by business impact.

Softprom and Rapid7

Softprom is the official distributor of Rapid7. Our team supports partners with licensing, technical enablement and proof-of-value projects based on the Rapid7 Command Platform.

Prepared by the Softprom editorial team based on vendor materials (Softprom DistriFlow). Source: original article.