Exploitation Trends in the First Half of 2025

Date: Tuesday, August 26th

Time: 9 AM PST / 12 PM EST

The first six months of 2025 saw a surge in real-world exploitation activity, with 432 CVEs exploited in the wild and nearly one-third weaponized at or before their public disclosure. This faster exploitation cycle is tightening defenders’ response windows and reinforcing the need for proactive vulnerability management. 

In this webinar, Patrick Garrity, Security Researcher at VulnCheck, and Wade Sparks, Senior Vulnerability Analyst at VulnCheck, will do an interactive deep dive with attendees on the newly released State of Exploitation - 1H 2025 research report.

We will cover the following discussion points (and more):

Rapid Weaponization and Shrinking Response Time: A third of exploited CVEs were attacked at or before public disclosure—highlighting the compressing window for patching

Threat Actor Shifts: Notable rise in exploitation activity attributed to Russia and Iran, while China and North Korea saw declines

 Attack Surface Focus: Proprietary systems—especially CMS plugins, edge devices, and server software—are currently more targeted than open-source projects.

Bring any and all questions you have about the current state of exploitation! We look forward to hosting this interactive session.