Mandiant’s M-Trends 2026 report tracks the mean time to exploit, the gap between a vulnerability becoming known and attackers first exploiting it, across its frontline caseload. In 2018, that window was roughly 63 days. It crossed zero in 2024. In 2025, it fell further still.
−7 DAYS
The estimated mean time to exploit newly disclosed vulnerabilities in Mandiant’s 2025 caseload — meaning exploitation is now routinely occurring before a patch is even available. [3]
A monthly vulnerability scan may no longer provide enough visibility. A delayed patching cycle may leave systems exposed before teams know a vulnerability exists. An investigation that takes several days to assemble may be completed only after an attacker has already established persistence or exfiltrated data.
When the time between exposure and exploitation collapses, historical evidence becomes critical. Security teams need to be able to look backwards and determine whether activity occurred before a vulnerability was disclosed or a detection rule was available. That requires more than retaining security alerts — it requires access to the underlying events:
The value of logging is not limited to detecting known threats in real time. Logs allow security teams to investigate newly discovered threats against activity that has already happened.
When mean time to exploit is negative, “we’ll add that log source once we see a problem” stops being a viable strategy — the intrusion may already be over by the time the problem is identified.
Snare Agent and Snare Central are built to collect and normalise the breadth of authentication, process, and administrative events this kind of retroactive investigation depends on, while Snare Reflector keeps that volume affordable enough to retain for as long as AI-accelerated exploitation now demands.
AskSnare then lets a team ask, the day a new CVE breaks, “have we already seen this pattern?” — turning historical logs into an early-warning system rather than an archive
