a16z: Critical CVE Reports Jump to 600+/Month and 87% of Exploited Bugs Hit on Disclosure Day

a16z's Charts of the Week reveal two data points marking a dangerous new phase for application security: critical vulnerability reports at 21 major software companies (Apple, AWS, Microsoft, Google, etc.) never exceeded 100 per month over the past four years, but surged past 600 per month starting this spring; and roughly 87% of exploited vulnerabilities are attacked on or before their public disclosure day, versus just 23% in 2020. The defenders' patching window has been compressed to nearly zero, posing a paradigm-level challenge to traditional application security.

Confirmed

a16z original data: monthly critical vulnerability reports at 21 large software firms jumped from a historical peak under 100 to 600+ (m1, m3, m4).
About 87% of actively exploited vulnerabilities are attacked on or before disclosure day, up from 23% in 2020 (m2, m3, m5).
a16z's charts also show tech hiring increasingly favoring experience (m1, m3).

Why it matters

Security researcher matrosov (relayed by cyb3rops) argues this is a paradigm crisis: traditional application security assumed defenders had days to think and patch—an assumption that no longer holds (m2).
@dbasch (relayed by StewartalsopIII) notes AI agents amplify the risk: attackers previously had to reverse-engineer security patches, a process AI now dramatically accelerates, directly linking the collapse of the patch window to AI's rise (m5).
The parabolic growth in vulnerability volume combined with faster exploitation means enterprises and security teams must shift from patch cycles toward more proactive defense and mitigation strategies (m4).

2026-09-06 ~ 2026-09-08 · 5 related posts

Primary sources

a16z charts: critical vulns jump to 600+/month as tech hiring shifts toward experience over skills — a16z · 2026-09-06 05:45 (UTC+08:00)
87% of Exploited Bugs Are Attacked On or Before Disclosure Day, Up from 23% in 2020 — a16z · 2026-09-07 03:30 (UTC+08:00)

[source] a16z charts: critical vulns jump to 600+/month as tech hiring shifts toward experience over skills — a16z · 2026-09-06
[source] 87% of Exploited Bugs Are Attacked On or Before Disclosure Day, Up from 23% in 2020 — a16z · 2026-09-07
a16z: Monthly critical CVEs at 21 major software firms jumped from under 100 to 600+ — FinanceYF5 · 2026-09-07
87% of exploited bugs are attacked on disclosure day, up from 23% in 2020, as AI collapses the patch window — cyb3rops · 2026-09-07
87% of exploited bugs are attacked on disclosure day, up from 23% in 2020 as AI agents shrink patch windows — StewartalsopIII · 2026-09-08