# Days to Patch

> Days to Patch grades software vendors on how fast they respond to exploited security bugs. Every number links to dated, archived evidence.

Methodology version 1.0.0. Data generated 2026-10-24T03:00:15Z.

## Pages

- [Live board](https://daystopatch.com/): exploited incidents not yet fixed for every version, with time elapsed.
- [Vendor report cards](https://daystopatch.com/vendors/): two grades per vendor. Response to exploited bugs is the headline and uses reviewed incidents only. Fixing privately reported bugs is the second. A+ to F. Provisional when evidence is thin, NR when there is too little.
- [Advisory changes](https://daystopatch.com/changes/): advisories that changed after publication. Before and after text, both archived versions, and whether the revision history records the change.
- [Sources](https://daystopatch.com/sources/): every source watched and its health.

## Data (JSON)

- [meta.json](https://daystopatch.com/data/meta.json): build time, methodology version, source health.
- [vendors.json](https://daystopatch.com/data/vendors.json): every vendor's grade, score interval, sub-scores and stats.
- https://daystopatch.com/data/vendors/<slug>.json: one vendor in full, with incidents, private cases and grade history.
- [incidents.json](https://daystopatch.com/data/incidents.json): every incident, newest first.
- https://daystopatch.com/data/incidents/<id>.json: one incident with every evidence candidate for each moment.
- [live.json](https://daystopatch.com/data/live.json): open incidents and the latest activity. Refreshed often.
- [edits.json](https://daystopatch.com/data/edits.json): every recorded advisory change (may be absent until the first change is found).
- [RSS](https://daystopatch.com/feed.xml); advisory changes: [RSS](https://daystopatch.com/changes/feed.xml)
- Badges: https://daystopatch.com/badge/<slug>.svg. Embeds: https://daystopatch.com/embed/clock/<id>/ and https://daystopatch.com/embed/grade/<slug>/ (?theme=auto|light|dark).

## Definitions

- world: first public report that the bug exists and is exploited or at risk.
- silence: hours from world to the vendor's first public statement.
- exposure: hours from world to the first fixed release.
- follow-through: hours from world to fixes for every supported branch.
- All timestamps are UTC. Day-precision dates never carry an invented time of day.

## Vendors

- [Cisco](https://daystopatch.com/vendors/cisco/): response A-; private fixes B-
- [SonicWall](https://daystopatch.com/vendors/sonicwall/): response B+ (provisional); private fixes B (provisional)
- [Citrix](https://daystopatch.com/vendors/citrix/): response B+ (provisional); private fixes not rated
- [BeyondTrust](https://daystopatch.com/vendors/beyondtrust/): response B+ (provisional); private fixes not rated
- [Ivanti](https://daystopatch.com/vendors/ivanti/): response B+ (provisional); private fixes C (provisional)
- [Fortinet](https://daystopatch.com/vendors/fortinet/): response B+ (provisional); private fixes C+
- [Check Point](https://daystopatch.com/vendors/check-point/): response B+ (provisional); private fixes not rated
- [Palo Alto Networks](https://daystopatch.com/vendors/palo-alto-networks/): response B (provisional); private fixes not rated
- [Oracle](https://daystopatch.com/vendors/oracle/): response B (provisional); private fixes B (provisional)
- [Microsoft](https://daystopatch.com/vendors/microsoft/): response B (provisional); private fixes C (provisional)
- [Adobe](https://daystopatch.com/vendors/adobe/): response not rated; private fixes B
- [Apple](https://daystopatch.com/vendors/apple/): response not rated; private fixes B
- [Atlassian](https://daystopatch.com/vendors/atlassian/): response not rated; private fixes not rated
- [Broadcom (VMware)](https://daystopatch.com/vendors/broadcom-vmware/): response not rated; private fixes B (provisional)
- [Commvault](https://daystopatch.com/vendors/commvault/): response not rated; private fixes not rated
- [ConnectWise](https://daystopatch.com/vendors/connectwise/): response not rated; private fixes not rated
- [CrushFTP](https://daystopatch.com/vendors/crushftp/): response not rated; private fixes not rated
- [Docker](https://daystopatch.com/vendors/docker/): response not rated; private fixes B- (provisional)
- [F5](https://daystopatch.com/vendors/f5/): response not rated; private fixes not rated
- [GitLab](https://daystopatch.com/vendors/gitlab/): response not rated; private fixes not rated
- [Google](https://daystopatch.com/vendors/google/): response not rated; private fixes C (provisional)
- [Juniper Networks](https://daystopatch.com/vendors/juniper/): response not rated; private fixes not rated
- [Linux kernel](https://daystopatch.com/vendors/linux-kernel/): response not rated; private fixes B- (provisional)
- [Mozilla](https://daystopatch.com/vendors/mozilla/): response not rated; private fixes B- (provisional)
- [N-able](https://daystopatch.com/vendors/n-able/): response not rated; private fixes not rated
- [Progress Software](https://daystopatch.com/vendors/progress/): response not rated; private fixes B
- [QNAP](https://daystopatch.com/vendors/qnap/): response not rated; private fixes C+ (provisional)
- [SAP](https://daystopatch.com/vendors/sap/): response not rated; private fixes not rated
- [SolarWinds](https://daystopatch.com/vendors/solarwinds/): response not rated; private fixes B- (provisional)
- [Sophos](https://daystopatch.com/vendors/sophos/): response not rated; private fixes not rated
- [Synology](https://daystopatch.com/vendors/synology/): response not rated; private fixes B- (provisional)
- [Trend Micro](https://daystopatch.com/vendors/trend-micro/): response not rated; private fixes C
- [Veeam](https://daystopatch.com/vendors/veeam/): response not rated; private fixes B- (provisional)
- [WatchGuard](https://daystopatch.com/vendors/watchguard/): response not rated; private fixes B- (provisional)
- [Zimbra (Synacor)](https://daystopatch.com/vendors/zimbra/): response not rated; private fixes not rated
- [Zyxel](https://daystopatch.com/vendors/zyxel/): response not rated; private fixes not rated