Smartphone Patch Gap: N-Day Exploit Window Simulator

Fleet & Rollout

Fleet size 256 devices

OEM/carrier patch delay 14 days

User update adoption 8%/day

Exploit released on day 30

Simulation speed 2.0 days/s

Live Status

Simulated day

Patched

Actively exploitable now

Cumulative exposure

0 dev-days

How it works

This models the real "N-day" patch gap: the time between a vendor publishing a security fix and a device actually being protected. Two delays stack up in series:

day_available(i) = D_oem + jitter_i
jitter_i ~ Uniform(0, 0.6 · D_oem)

each day once available:
  P(install today) = a   (adoption rate)
→ day_patched(i) ≈ day_available(i) + Geometric(a)

D_oem is the carrier/OEM testing-and-rollout delay (fragmentation — Android device makers vary hugely here; Apple's is short). jitter_i spreads that delay across the fleet since not every model/carrier ships the same day. a is the fraction of users who install an available update on any given day — most fleets never reach 100%.

If an exploit is weaponised on day E, every device that is still unpatched from day E onward is actively at risk. The simulator accumulates a real security metric, cumulative exposure, in device-days:

Exposure = Σ_i Σ_{t=E}^{min(T, day_patched(i)-1)} 1

Colour key: blue = unpatched, no active exploit yet · red = unpatched while the exploit is live (actively exploitable) · green = patched and safe. Real fleets minimise the red region by shortening D_oem (fast vendor→OEM→carrier pipelines) and raising a (forced/auto updates, update reminders) — the same two levers this simulator exposes.

Day 0

Unpatched (no active exploit) Unpatched & actively exploitable Patched

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.