Attacker activity changes shape in the week before a CVE is disclosed
Original research from 120 days of Lupovis sensor telemetry shows vendor-aligned anomalies clustering one to seven days ahead of public disclosure, backed by a formal statistical test.
Lupovis Intelligence research report
.png)
An analysis of attacker activity against exposed enterprise systems, testing whether changes in behaviour give defenders earlier warning than CVE and KEV feeds.
February to May 2026
12 path families including Ivanti, Fortinet, Citrix and Palo Alto
Vulnerability prioritisation and threat hunting
19 page PDF, TLP:CLEAR
Get research and insights on the vulnerabilities attackers are exploiting and what they mean for your defences.
Summary
Vulnerability programmes usually start moving when an advisory is published, by which point attackers have often been probing the affected technology for days.
We analysed 120 days of telemetry from the Lupovis sensor network to test whether that earlier activity is visible and measurable. Of 31 vendor aligned spike events that paired with a public CVE, 19 began between one and seven days before the disclosure date.
A permutation test across 1,000 randomised trials shows this concentration is very unlikely to be chance, giving defenders a credible reason to start exposure review before the advisory cycle completes.
The question
Testing whether attacker behaviour moves ahead of disclosure
Aggregated threat feeds describe what has already happened, and advisory and patching processes take time to turn new information into action. Every organisation running the affected technology tends to react at the same moment.
We wanted to know whether activity on exposed enterprise paths shifts in a consistent way before disclosure, and whether that shift is strong enough to act on.
How we tested it
A two channel signal with a formal null model
A day only counted as a surge when session volume and the number of unique source IPs both rose above two independent baselines at the same time. This filters out single noisy scanners and broad shallow sweeps, leaving 55 clustered spike events across the window.
Vendor specific events were then matched against CVE disclosures for the same vendor within a 21 day forward window. To rule out coincidence we kept every spike date fixed and randomised the disclosure dates 1,000 times. Chance produced around five pairings in the one to seven day window on average and never more than 13, against 19 in the real data.
What we found
Vendor aligned activity clusters in the final week
More than 60% of paired events began within a working week of public disclosure. Fortinet showed the pattern most clearly, with three April events pairing with the same CVE at lead times that shortened from seven days to four and then two as disclosure approached.
Different surfaces produce different signals
Attacker interest takes distinct shapes. Ivanti saw sustained pressure over six days in late April, with more than 45,000 sessions. Git paths drew the widest participation of any surface, with low repeat activity per source pointing to opportunistic discovery of exposed repositories. Each shape calls for a different defensive response.
What it means for defenders
An earlier start on exposure review
When a vendor specific path becomes anomalous, the data supports treating it as a prompt to confirm exposure, review logs and move patching up the queue. The signal won’t tell you which CVE is coming, and not every disclosure is preceded by one, but it gives teams time they currently don’t have.
Inside the full report
- The complete methodology and permutation test specification, with limitations
- Full case studies with daily session timelines and paired CVE details
- A watchlist of the eleven ASNs that touched nine or more path families
- A defender workflow mapping each signal type to a practical next step