The CrowdStrike 2026 Threat Hunting Report puts a hard number on something defenders have felt for years. From January through June 2026, 88 percent of the exploitation CrowdStrike observed against vulnerabilities with publicly released exploit code happened within 48 hours of that code being published. Some adversaries did not wait for public exploit code at all: China-nexus groups VAULT PANDA and GENESIS PANDA launched deliberate attacks within 24 hours of a critical web application vulnerability being disclosed.
CrowdStrike expects that window to keep shrinking. The pattern predates frontier AI models, but the report assesses that AI is likely to compress exploitation timelines further by accelerating vulnerability discovery and exploit development.
This third installment in our series on the report looks at what that compression means for evidence. The short version: when exploitation follows disclosure within hours, the evidence you need was created before you knew you needed it.
Patching Alone Cannot Win a 48-Hour Race
Patching remains the fix. Nothing here changes that. But most organizations cannot test and deploy a patch to every affected system in under two days, and some systems cannot be patched quickly at all. That leaves a gap between disclosure and remediation, and the 2026 data says that gap is when exploitation happens.
During that gap, security teams face questions that patching does not answer. Which systems are exposed? Has anything already reached them? If one was compromised, what did it do next? These are investigation questions, and they share an awkward property: the activity they ask about may have started before anyone knew there was a vulnerability to look for. And for flaws attackers find first, exploitation can begin before disclosure at all, which pushes the investigation window further into the past.
A new vulnerability turns the past into the crime scene. You can only search the evidence you were already collecting.
Three Questions for the First Hours
Network flow answers all three, because every exposure, probe, exploit, and follow-on connection crosses the network. The condition is that the flow was already being collected, enriched, and retained in a form hunters can search.
| Question (answered in Splunk) | Network evidence that answers it |
| Which of our systems are reachable on the vulnerable service from outside? | Inbound flow records from external addresses to the port the vulnerable service listens on, showing which internal hosts are receiving internet traffic there: exposure in practice, alongside the vulnerability scanner’s view of what software is running |
| Has anything already probed or exploited the exposed systems? | Retained, enriched flow history for those hosts, searched back across the window, with newly published indicators matched against stored source addresses |
| If a host was compromised, what did it do next? | Outbound connections to new destinations, unusual data volumes, and internal connections to hosts it does not normally talk to, with GeoIP/ASN and threat intelligence context |
The first question is often the most urgent. An asset inventory or vulnerability scanner says which systems run the affected software. Flow says which of them are receiving connections from the internet on that service right now. The two views together tell a team where to patch first and where to start looking.
Separating the Noise from the Real Attack
The first hours after exploit code goes public are loud. In the report’s account of CVE-2026-31431, a Linux privilege escalation vulnerability, roughly 94 percent of the events CrowdStrike saw in the first 24 hours were testing behavior based on the public code. Inside that noise, CrowdStrike uncovered activity from the Belarus-nexus adversary UMBRAL BISON just over 20 hours after disclosure. After the React2Shell disclosure, CrowdStrike OverWatch worked more than 800 hunting leads across more than 80 victims in four days.
Volume like that makes context decisive. A scan from a cloud hosting range that received no response is a different story from a connection that moved data in both directions and was followed by new outbound traffic from the target. Enrichment carried on every flow record, including user identity where a mapping exists, application, threat intelligence, and GeoIP/ASN, is what lets hunters sort the two quickly instead of pivoting through raw IP addresses one at a time.
Evidence Has to Exist Before the Exploit Does
NetFlow Optimizer (NFO) fits this property of the problem: it collects continuously, so the evidence is already there when the question arrives. NFO receives NetFlow, IPFIX, sFlow, and J-Flow from multi-vendor network devices, enriches each record at collection time, and reduces volume by 80 to 90 percent, primarily through aggregation. That reduction is what makes weeks or months of searchable network history affordable in Splunk, delivered CIM-compliant and ready for the hunt.
One detail matters here. Threat intelligence enrichment reflects the indicators known when a record is collected. Indicators published after a disclosure, such as the infrastructure behind a new exploitation campaign, are matched in Splunk against the addresses already stored. Retention is what makes that retrospective match possible. Without it, the newest and most relevant indicators have nothing to match against.
As always, NFO does not detect, alert, or decide what is malicious. It collects, enriches, reduces, and delivers. The hunting, correlation, and response happen in Splunk, where the network evidence sits beside endpoint, identity, and vulnerability data.
The Bottom Line
The CrowdStrike 2026 Threat Hunting Report shows exploitation now following publicly released exploit code within 48 hours in most observed cases, and some adversaries attacking within 24 hours of disclosure. Patching cannot close that window alone, and the investigation questions it raises reach back to activity that happened before anyone knew to look. NFO keeps enriched, CIM-compliant network evidence flowing into Splunk continuously and at a volume that can be retained, so when the next disclosure lands, the history hunters need already exists.
You cannot collect yesterday’s evidence tomorrow. Start collecting it today.
This is the third post in our series on the CrowdStrike 2026 Threat Hunting Report. Read part one, The Evasive Adversary and the Network Layer, and part two, Where No Agent Runs.
Want enriched network evidence that is already in Splunk when the next vulnerability drops? Start a free 60-day trial of NetFlow Optimizer or schedule a technical demo with a NetFlow Logic engineer.
Start Free Trial | Schedule a Demo | Splunk Integration | NFO Documentation