Every disclosed vulnerability starts a race between defenders rolling out a patch and attackers turning the flaw into a working exploit. This model runs 150 systems through that race day by day.
Patch day (per system):
patchDay_i = releaseDay − ln(1−u_i)/λ, λ = ln2 / medianDays
Exploit reliability ramp:
r(t) = rMax · smoothstep((t − exploitDay) / weaponizeDays)
Daily compromise hazard (unpatched systems):
P(compromise on day t) = r(t) · 0.12
Exposure score = Σ unpatchedFraction(t) · r(t) over all days
- Coordinated disclosure — the exploit only goes public 14 days after the patch ships, giving defenders a head start.
- Full disclosure — the flaw and proof-of-concept are public from day 0, so attackers and defenders start the race together.
- Active 0-day (ITW) — attackers were already exploiting the flaw for a week before anyone else knew, so the exploit is already partly weaponized when the clock starts.
- Each system's own patch day is drawn from an exponential distribution around the release delay — real fleets never patch in lockstep, some machines lag for months.
This is the same "window of exposure" reasoning behind responsible-disclosure policies (e.g. 90-day embargoes): the longer the gap between an exploit existing and a patch being widely deployed, the more systems fall in the amber zone.