Patches Pushed Are Not Patches Landed
Weekly field intelligence for enterprise mobile security leaders.
A security director told me last week that she had a patch-rate number, but she did not fully trust it. The dashboard could tell her what was marked complete. It could not tell her whether the vulnerabilities attackers care about were actually closed across the environment.
Two numbers from Verizon's 2026 Data Breach Investigations Report tell the story when you put them together. The report analyzed more than 31,000 security incidents, including more than 22,000 confirmed breaches, nearly double the prior year's confirmed breach count. Vulnerability exploitation passed stolen credentials as the leading breach entry point, while organizations fully remediated only 26% of vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, down from 38% the year before. Median time to full patching rose to 43 days.
Attackers are moving faster, and known-exploited vulnerabilities are getting fixed less often. For a mobile fleet, that is not an abstract industry statistic. Verizon's DBIR does not tell you your mobile KEV remediation rate. It does not tell you which flaws are still open across your phones, tablets, apps, unmanaged devices, and mobile-adjacent infrastructure. Most teams do not have that number either. So the question this week is not whether patching is hard. It is which known-exploited mobile flaws in your environment are sitting inside the 74% that did not get fixed.
Signals & Moves You Shouldn't Ignore
The share of known-exploited flaws getting patched is falling, not rising.
The DBIR's most uncomfortable finding is a direction, not just a number. Organizations patched 26% of the vulnerabilities in CISA's KEV catalog, down from 38% the prior year. These are not theoretical vulnerabilities — the KEV catalog is, by definition, the list of flaws confirmed to be exploited in the wild. A declining remediation rate against that specific list means the gap between "known to be actively dangerous" and "actually fixed" is widening. Whatever the causes — patch volume, resource limits, competing priorities — the trend line is moving the wrong way against the flaws that matter most.
The exploitation window is shrinking while the remediation window grows.
Median full-patching time rose to 43 days, up from 32 the year before. Over the same period, AI-accelerated exploitation has compressed the time from disclosure to active attack from months toward hours — Verizon's own framing. Those two trends move in opposite directions, and the space between them is the exposure. A flaw that takes six weeks to patch across a fleet, against an exploit that can appear within days of disclosure, leaves a window where the vulnerability is both known and unfixed. The patch will arrive. The question is what happens in the interval.
Vulnerability exploitation has overtaken stolen credentials as the leading breach entry point.
For years, stolen credentials held that position. Not anymore. The 2026 DBIR reports vulnerability exploitation at 31% of breaches versus stolen credentials at 13%. The shift matters for how mobile security programs prioritize: a credential-first threat model focuses on authentication and MFA. An exploitation-first threat model has to ask which unpatched flaws an attacker can reach on mobile devices, and whether those devices will even receive the fix. Those are harder questions, and fewer programs are set up to answer them.
Mobile makes the patch gap harder to prove, not easier.
A widening patch gap is an industry-wide problem, but mobile fleets sit at the awkward end of it. On many server workloads, the enterprise has more direct control over the remediation path. On mobile, the fix often runs through OEM support, carrier delivery, user update behavior, MDM visibility, and devices that may already be outside a defensible support window.
So the DBIR's falling KEV-remediation rate should make mobile teams ask a narrower question: not "did we push the update?" but "which high-access devices can we prove are actually remediated?" My read: the 26% figure is probably closer to the floor than the ceiling for mobile programs, because mobile remediation depends on inventory quality, OEM support, carrier delivery, user behavior, and verification after rollout.
Phone-centric social engineering is succeeding at a rate 40% higher than email phishing.
The same dataset found that 62% of breaches involved a human element. SecurityWeek's analysis also noted that phone-centric social engineering, including SMS and voice, succeeded at a rate 40% higher than traditional email phishing.
That matters for mobile because patching is only one side of the exposure. The same device that may be missing a known-exploited fix is also where the employee receives the text, answers the call, approves the prompt, opens the link, and hands over the credential. That is why mobile belongs in the breach conversation, not buried in the endpoint inventory.
The One Thing That Matters This Week
A mobile patch rate you cannot state is a risk you are probably carrying on assumption.
The industry remediated 26% of known-exploited vulnerabilities last year. The useful exercise is not to debate that number. It is to find your own number for the mobile devices that matter.
Start with the Pocket Attack Surface: which phones, tablets, unmanaged devices, apps, and mobile-adjacent systems hold access to enterprise systems. Then map the KEV catalog against that inventory. The question is direct: of the mobile devices with standing access to enterprise systems, what percentage have every applicable known-exploited vulnerability actually remediated, and how long did the last few take to close?
That is your real remediation rate. It is usually not the same number your compliance dashboard shows, because the dashboard often measures what was pushed, assigned, or marked complete. It does not always prove the fix landed on the device that still has access.
That gap is Verification Latency: the amount of time your program operates on assumption after a patch is released, pushed, or reported by tooling, but before the device itself is verified as closed. Most programs have never measured that gap against the KEV list specifically. So they cannot say whether their mobile fleet is above or below the industry's 26% remediation rate. The work this week is to produce one honest number. Once you can state it, you can defend it. More importantly, you can improve it.
The method for running this exercise, and what to do when you find the gap, is in the 2026 Mobile Risk Report.
My Take
Every year the DBIR lands, the industry talks about it for a week, and then most teams move on.
The number mobile programs should sit with this year is the direction of the KEV remediation rate. It went down. In a year when everyone knew exploitation was accelerating, the share of confirmed-dangerous flaws getting fixed fell by roughly a third.
I don't think the main story is negligence. I think it is capacity. Patch volume is rising faster than teams can absorb it, and the fixes that require the most coordination are usually the first to slip. On mobile, those are often the patches that depend on OEMs, carriers, app owners, device state, user behavior, and management coverage. That is where the slippage concentrates. The industry number is already low. The mobile number is usually worse.
The work now is to stop treating "patch pushed" as the finish line. The number that matters is patches landed, on the devices that still have access, against the flaws known to be exploited. That number is harder to produce. It is also the one your board will eventually ask for. Better to have it before they do.
— William
One Thing Worth Doing This Week
Measure your real KEV remediation rate for one high-value device group.
Pick one group of mobile devices with standing access to something that matters — the executive fleet, the finance team, the clinicians, whichever is highest-stakes. Pull the current CISA KEV catalog and identify every entry that applies to the operating systems and components those devices run. Then check, device by device or through your management tooling, how many of those specific flaws are actually remediated on those specific devices — not scheduled, not pushed, actually closed.
Divide fixed by applicable. That percentage is your real KEV remediation rate for the group. Compare it to the industry's 26% and to your own compliance dashboard's number. Where the three diverge, the space between them is the story: it tells you how much of your reported posture is patches landed versus patches merely sent.
The output is one defensible figure per device group, with the gap between pushed and landed made explicit. That number can survive a boardroom because it measures exposure, not effort.
📄 Get the 2026 Mobile Risk Report → mobilesecurityguru.com/report
(Six questions, instant access. No sales call required.)
Trust Boundary Index — Week in Review
TRUST BOUNDARY INDEX | Issue 011 | July 3, 2026
Transport █████░░░░░ MEDIUM — Patching latency affects network-adjacent mobile
infrastructure; VPN and SD-WAN edges remain exposed
Behavior ███████░░░ HIGH — Phone-centric social engineering outperforms email;
human behavior is the mobile breach multiplier
Identity ██████░░░░ MEDIUM — Stolen credentials fell as primary entry point, but
credential reuse still amplifies mobile exploitation
Inference ████████░░ HIGH — Verification Latency is the unifying gap: pushed vs
landed is the metric most programs are missing
This week's dominant pattern: Exploitation is accelerating faster than remediation,
especially on mobile where the gap between patch pushed and patch landed is widest.Every Friday. Five items. One action.
What is your real KEV remediation rate for the mobile devices that hold your most sensitive access?
#MobileSecurity #CISO #VulnerabilityManagement #BYOD #cybersecurity