Resurgent vulnerabilities pose an unorthodox threat to cyber defense, complicating how defenders patch vulnerabilities and detect emerging threats. These vulnerabilities, which can resurface after extended periods of inactivity, are more than just a technical challenge; they are a strategic weakness actively exploited by opportunistic attackers from every corner of the internet.
Recent research from GreyNoise Intelligence indicates that resurgent vulnerabilities disproportionately impact edge technologies - entry points into networks that, when compromised, can lead to significant disruption, exposure of sensitive information, and adversarial persistence in vital systems.
Four Types of Vulnerabilities: A Behavioural Taxonomy
GreyNoise analyzed a dataset of known exploited vulnerabilities (KEVs) in internet-exposed systems published between 2010 and 2020, and determined there are four main categories, each exhibiting a unique set of characteristics:
Resurgent vulnerabilities clearly present distinct threats to digital infrastructure - and one of the key takeaways from this research lies in their close relationship with edge technologies, the very systems threat actors are increasingly using to gain deep and persistent access to networks and data.
GreyNoise's analysis revealed that resurgent vulnerabilities disproportionately affect edge technologies. Over 50% of the most exploited resurgent flaws - and nearly 70% of the most unpredictable vulnerabilities (Black Swan) - affect edge technologies. This pattern demonstrates the urgent need for proactive mitigation strategies, as the exploitation of resurgent vulnerabilities directly threatens organizational security.
Edge Black Swans combine an unorthodox behavior (resurgence) with a technology type increasingly targeted by both opportunistic and advanced state actors.
According to the 2025 Verizon Data Breach Investigations Report (DBIR), the exploitation of edge KEVs begins immediately , with the median time from disclosure to mass exploitation at zero days, in comparison with five days for all KEVs. Another striking finding - edge vulnerabilities were used in 22% of breaches involving vulnerability exploitation, an eightfold increase from 3% last year.
Consequently, defenders are starting to prioritize edge vulnerabilities faster and more frequently - 54% of edge KEVs were remediated (in comparison to 38% of all KEVS), with a median time of 32 days (in comparison to 38 days for all KEVs). Nevertheless, nearly one in three edge KEVs are left fully remediated, representing the highest rate of non-remediation among CVEs and KEVs tracked by the DBIR.
Tips for Security Professionals
The following recommendations outline four essential steps security professionals should take to strengthen our defense against the resurgence phenomenon, particularly with respect to edge technologies:
Now is the time to confront the evolving threat landscape with decisive and informed action, securing organizational security with improved defensive measures and policy actions.
By understanding how and why resurgent vulnerabilities are exploited, we can build a more resilient cyber defense strategy - one that proactively addresses not just the known risks but also the unexpected.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
