Why the first day?
Attackers read the same advisories you do. For widely deployed internet-facing software, scanning for a newly published weakness can start within hours. The gap between publication and your first decision is the window an attacker has without competition.
Hour 0 to 4: match the CVE to your assets
Start with the inventory. Which internet-facing assets run the affected product and version? This is where discovery quality pays off: an asset nobody listed cannot be matched. Note the assets where the version cannot be read; they are uncertain, not safe.
Hour 4 to 12: prove which assets are affected
Version matching over-reports and under-reports. A safe validation test answers the real question for each matched asset: is the vulnerable path reachable and usable? Check the CISA KEV catalog too; a CVE listed there has reliable evidence of active exploitation and a clear remediation action, which raises the priority of any proven match.
Hour 12 to 24: contain what cannot be patched today
For proven exposures that the owner cannot patch the same day, put a compensating control in place: a WAF or edge rule that blocks the attack path, taking the service off the internet, or restricting access to known addresses. Lesson 7 covers the options and their limits.
Throughout: route with a deadline
Every proven exposure gets a ticket to its owner with the evidence attached and a fix date. A contained exposure still needs the fix; the control is temporary.
What do vendors document for this window?
Timings below are the vendors' own statements, not measurements by this site.
- IONIX describes Live Exposure Defense, released in May 2026, which correlates each newly published CVE with a customer's internet-facing assets, confirms exploitability through safe active testing and delivers a mitigation workflow within 12 hours. Its WAF Posture Management page describes turning a CVE into a deployable WAF rule within 12 hours of publication.
- watchTowr describes Rapid Reaction, re-testing the hour a new threat emerges, and pushes mitigation rules to edge vendors through Active Defense. For Project Red it states it reproduced CVE-2026-63030 in 22 minutes.
- Hadrian states it proves exploitability within 15 minutes and runs scans hourly or triggered by events.
What should you ask a vendor about this window?
- How soon after publication does the tool test for a new CVE, and is that automatic?
- What does it do with assets it cannot fingerprint?
- Can it produce or push a compensating control, and to which of your WAFs or edge services?
- Does it retest when the owner reports the fix?
The answers map directly to the PROVEN, CONTAINED and RECHECKED stations on each tool's closure track.