If you run support or managed services for other people’s systems, you have probably noticed that the conversation with customers about security has changed tone this year. It used to be “are you scanning?” Now it is “how fast do things get fixed, and can you prove it?” That shift is the heart of VulnerabilityOps, and the tail end of 2026 suits a quick audit of the field: what the numbers say, which rules have just shifted, and what support teams ought to do. Think of this as a friendly state-of-play note rather than a forecast.<\/p>\n
The Ops Atlas, a reference that catalogues operating disciplines, tracks the volume of published vulnerabilities. Yearly CVE output has more than doubled since 2020, and by the end of June 2026 another 35,872 had already been published, which puts the full year on course to top 2025. Over the same stretch the Atlas notes a study from 2019 reporting that a typical organisation clears around a tenth of its open weaknesses in a month. Anyone who staffs a help desk knows what happens when incoming tickets outrun closures: the queue lengthens and the oldest customers get angry.<\/p>\n
That is why the Atlas description of VulnerabilityOps<\/a> insists on measuring arrivals against verified closures in each priority tier. A ratio above one is an early-warning light; below one means the backlog is falling.<\/p>\n The same entry quotes Mandiant research showing that the typical time from disclosure to exploitation for flaws used in 2023 was about five days once outliers were removed, down from 63 days in 2018 and 2019, with 70 percent of those flaws being zero-days. A 2026 Verizon report, also cited, ranks exploitation of vulnerabilities as the most common way in at 31 percent of cases, and finds that organisations fully fixed only 26 percent of items on the exploited-flaw list during 2025, down from 38 percent the year before, taking a median of 43 days.<\/p>\n For a managed-services provider, this is the uncomfortable number. If you take 43 days and attackers need five, the weekly patch meeting is not going to cut it for the dangerous minority of issues. It does not mean everything has to be fixed in five days; it means a very small slice does, and the rest can be scheduled.<\/p>\n In June 2026 the US cyber agency issued a binding directive, BOD 26-04, that swapped the old severity bands for clocks computed from four facts: internet exposure, membership of the exploited list, scriptability of the attack, and the extent of the technical damage. The directive binds only federal civilian agencies, and the agency grants no waivers. Still, the structure is easy to borrow. The Atlas counts 131 later additions to that list: 108 of them landed on a three-day deadline, the other 23 on fourteen days.<\/p>\n Alignment is spreading by contract. FedRAMP participants must align by 7 December 2026, so providers who serve such customers are already being asked about it. In Europe, manufacturers have owed a 24-hour early warning under the Cyber Resilience Act since 11 September 2026, and the EU’s own vulnerability database, operated by ENISA, is live under the NIS2 framework. Whether any of it binds you is something to settle with your own advisers; the trend is simply that customers will raise it.<\/p>\n A less discussed development is that the shared dataset is under strain. The US national database changed course in mid-April 2026 and now enriches just the records it ranks as priorities. According to the Atlas, on 17 October 2026 it held 57,074 entries marked as deferred and 7,563 waiting for enrichment. If your tooling relies on enriched fields to rank work, some items will quietly drop out of sight. The remedy is boring and effective: reconcile more than one feed and report the number of records with blanks.<\/p>\n There is also a supply-chain lesson tucked inside. In March 2026 a tampered release of a widely used open-source scanner was distributed after tags used by a build action were redirected. The scanners and their credentials are now treated as part of the attack surface.<\/p>\n The Atlas separates two documented emphases. The earlier, from an October 2025 essay, is about turning AI-assisted vulnerability research into an operational capability. The later, from industry notes in May and August 2026, is about vulnerability management as a flow. They converge on the same constraint: if discovery gets cheaper, arrivals rise, and capacity to fix becomes the scarce resource. The Atlas places the topic at the emerging-label stage, with no formal standard behind it.<\/p>\n A word on how this plays out in a typical managed engagement. A customer opens a ticket saying a scanner flagged forty items on a shared host. Under the old routine, the support engineer patches what they can in the next window and replies “done”. Under a flow approach, the same engineer first asks which of the forty are reachable from outside, which appear on the exploited list, and who owns the application on that host. Perhaps three items matter this week, ten can wait for the next upgrade, and the rest are noise from an unauthenticated scan that cannot see local packages. The customer gets a shorter list, a date for each item and a promise of evidence, and the engineer gets fewer angry callbacks.<\/p>\n For containerised customers, the practical details of securing clusters are covered in our guide to Kubernetes security for practitioners<\/a>, and the cultural side of keeping delivery steady while tightening controls is the theme of the principles that underpin dependable software delivery<\/a>.<\/p>\n I would keep an eye on four things. First, whether clock-based policies spread from federal agencies to commercial contracts. Second, whether the national database’s backlog shrinks or the deferred list keeps growing. Third, whether the exploited-list remediation rate recovers from 26 percent. Fourth, whether more organisations climb the Atlas maturity ladder, a five-rung scale that starts with scan-and-react and ends in an adaptive stage the Atlas calls remediation as code.<\/p>\n None of this requires a big purchase. It needs a calendar, a few honest numbers and the willingness to tell a customer, kindly, that a closed ticket is not yet a fixed system. Support teams are good at that conversation, and this year it is a competitive advantage.<\/p>\n","protected":false},"excerpt":{"rendered":" Five trends shaping VulnerabilityOps this year, from record flaw volume to deadline-based policy, and what managed-services teams should do about them.<\/p>\n","protected":false},"author":8,"featured_media":5491,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3948],"tags":[],"class_list":["post-5490","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops-support"],"_links":{"self":[{"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/posts\/5490","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/comments?post=5490"}],"version-history":[{"count":1,"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/posts\/5490\/revisions"}],"predecessor-version":[{"id":5605,"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/posts\/5490\/revisions\/5605"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/media\/5491"}],"wp:attachment":[{"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/media?parent=5490"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/categories?post=5490"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopssupport.in\/blog\/wp-json\/wp\/v2\/tags?post=5490"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Trend two: attackers are faster<\/h2>\n
Trend three: deadlines are replacing severity bands<\/h2>\n
Trend four: the data underneath is thinning<\/h2>\n
Trend five: two schools of thought, converging<\/h2>\n
What this means for a support team<\/h2>\n
\n
What to watch in the next two quarters<\/h2>\n