The figures
All three are the vendors' own statements, read in September 2026.
- Hadrian states it proves exploitability within 15 minutes.
- watchTowr states that Project Red, announced in July 2026, reproduced CVE-2026-63030 in 22 minutes. Separately, watchTowr describes re-testing the hour a new threat emerges.
- IONIX states it turns a CVE into a deployable WAF rule within 12 hours of the CVE's publication, and describes Live Exposure Defense delivering a mitigation workflow within 12 hours.
Why they cannot be compared
Each figure runs a different clock.
- Hadrian's 15 minutes describes proving exploitability; the page does not say exactly when the clock starts, for example at discovery of the asset or at the start of a test.
- watchTowr's 22 minutes describes reproducing one specific vulnerability, a research step that comes before testing customers' assets.
- IONIX's 12 hours starts at CVE publication and ends with a deployable rule or a mitigation workflow, which spans matching, validation and producing a control.
A faster-looking number can describe a shorter stretch of work. None of them, on its own, tells you how long your exposure stays open.
What clock matters to you?
The one that runs from "an attacker could exploit this" to "an attacker can no longer exploit this". In practice that splits into:
- time from CVE publication to knowing which of your assets are affected;
- time from knowing to a compensating control being live;
- time from knowing to the fix, confirmed by a retest.
How to time it yourself
In a proof of concept, plant a known exposure in a test environment you control and are allowed to expose, and record timestamps: when it went live, when each tool found it, when each proved it, when each proposed or pushed a control, when the ticket arrived, and when the retest confirmed the fix. Do the same after the next real critical CVE: note when it was published and when each tool reported your affected assets.
How we treat speed claims
We report them as claims and do not score them as fact. They inform the questions we ask, not the numbers we give. Our scores reward what a vendor documents specifically: that a step exists, how it works and what it produces.