Attackers keep coming back to the same components.
41% of all flaws exploited from 2021 to 2025 hit just 39 products, each exploited in three or more separate years. Patching flaw by flaw never ends. Harden the component instead.
Same components. Every year.
Each dot is one flaw attackers used, grouped by the kind of weakness behind it.
Vulnerable is a flaw. Susceptible is a component.
Why the same components keep coming back.
Patching flaw by flaw is a treadmill.
Teams fix one CVE at a time. The same component produces the next.
Patch one. The next is already coming.Real exploited flaws in Chromium V8, oldest first.
Four questions about a component's past.
Each yes adds points, up to 6. Pick a product to see how it scored at the end of 2024.
Plus three questions only your environment can answer: where it runs, whether attackers can reach it, and who is targeting it now. They are not part of the public test.
Scored in 2024. Exploited in 2025?
Nine well-known products, with the scores they had on 31 December 2024. Press play to see which ones attackers exploited the next year.
Where do you stand?
Six questions on finding susceptible components, and fixing them.
What curl teaches about components that hold.
Which signals predicted next year's exploited list, which failed, and a one-page worksheet for your own inventory.
By Or Naim and Ben Hunter, Reclaim Security. Privacy