{"id":"https://openalex.org/W7204245656","doi":"https://doi.org/10.5281/zenodo.22113924","title":"Vulnerability Remediation Is Not Preemptive Defense: A Coverage-Ceiling, Disclosure-Race, and Residual-Exposure Model for IT and Operational Technology","display_name":"Vulnerability Remediation Is Not Preemptive Defense: A Coverage-Ceiling, Disclosure-Race, and Residual-Exposure Model for IT and Operational Technology","publication_year":2026,"publication_date":"2026-08-26","ids":{"openalex":"https://openalex.org/W7204245656","doi":"https://doi.org/10.5281/zenodo.22113924"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.22113924","doi":"https://doi.org/10.5281/zenodo.22113924","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22113924","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.22113924","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5140668054","display_name":"Francesco Trama","orcid":"https://orcid.org/0009-0004-8437-6351","observed_orcids":["https://orcid.org/0009-0004-8437-6351"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Trama, Francesco","raw_affiliation_strings":["PacketViper, LLC"],"raw_orcid":"https://orcid.org/0009-0004-8437-6351","affiliations":[{"raw_affiliation_string":"PacketViper, LLC","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5140668054"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9854000210762024,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9854000210762024,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.01360000018030405,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability-remediation","display_name":"vulnerability remediation","score":0.9919999837875366},{"id":"https://openalex.org/keywords/patching","display_name":"patching","score":0.8389999866485596},{"id":"https://openalex.org/keywords/vulnerability-disclosure","display_name":"vulnerability disclosure","score":0.45100000500679016},{"id":"https://openalex.org/keywords/cybersecurity","display_name":"cybersecurity","score":0.4740000069141388},{"id":"https://openalex.org/keywords/operational-technology","display_name":"operational technology","score":0.878000020980835},{"id":"https://openalex.org/keywords/vulnerability-exploitation","display_name":"vulnerability exploitation","score":0.41200000047683716},{"id":"https://openalex.org/keywords/initial-access","display_name":"initial access","score":0.47099998593330383},{"id":"https://openalex.org/keywords/security-controls","display_name":"security countermeasures","score":0.3580000102519989}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6342999935150146},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6337000131607056},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5623000264167786},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5407999753952026},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.5303999781608582},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5285000205039978},{"id":"https://openalex.org/C111219384","wikidata":"https://www.wikidata.org/wiki/Q6954384","display_name":"NIST","level":2,"score":0.4902999997138977},{"id":"https://openalex.org/C169087156","wikidata":"https://www.wikidata.org/wiki/Q2131593","display_name":"Framing (construction)","level":2,"score":0.4341999888420105},{"id":"https://openalex.org/C100207952","wikidata":"https://www.wikidata.org/wiki/Q7311597","display_name":"Remedial education","level":2,"score":0.41990000009536743},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.39340001344680786},{"id":"https://openalex.org/C2777489069","wikidata":"https://www.wikidata.org/wiki/Q1589822","display_name":"Ceiling (cloud)","level":2,"score":0.3614000082015991},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.3540000021457672},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3386000096797943},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3273000121116638},{"id":"https://openalex.org/C146834321","wikidata":"https://www.wikidata.org/wiki/Q2979672","display_name":"Closure (psychology)","level":2,"score":0.3260999917984009},{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.3253999948501587},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.3098999857902527},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.3089999854564667},{"id":"https://openalex.org/C155223936","wikidata":"https://www.wikidata.org/wiki/Q682875","display_name":"Domino effect","level":2,"score":0.30320000648498535},{"id":"https://openalex.org/C197115733","wikidata":"https://www.wikidata.org/wiki/Q1003136","display_name":"Forcing (mathematics)","level":2,"score":0.30140000581741333},{"id":"https://openalex.org/C2777693866","wikidata":"https://www.wikidata.org/wiki/Q359099","display_name":"Blackout","level":4,"score":0.3010999858379364},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.2953000068664551},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.28769999742507935},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.2759000062942505},{"id":"https://openalex.org/C522964758","wikidata":"https://www.wikidata.org/wiki/Q2019586","display_name":"Environmental remediation","level":3,"score":0.26649999618530273},{"id":"https://openalex.org/C21200559","wikidata":"https://www.wikidata.org/wiki/Q7451068","display_name":"Sensitivity (control systems)","level":2,"score":0.2619999945163727},{"id":"https://openalex.org/C9354725","wikidata":"https://www.wikidata.org/wiki/Q286017","display_name":"Operationalization","level":2,"score":0.258899986743927},{"id":"https://openalex.org/C85973986","wikidata":"https://www.wikidata.org/wiki/Q1091731","display_name":"Exploratory research","level":2,"score":0.2540000081062317}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.22113924","doi":"https://doi.org/10.5281/zenodo.22113924","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22113924","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22113925","doi":"https://doi.org/10.5281/zenodo.22113925","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22113925","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.22113924","doi":"https://doi.org/10.5281/zenodo.22113924","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22113924","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, justice, and strong institutions","score":0.7399596571922302}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":1,"referenced_works":["https://openalex.org/W7204196988"],"related_works":[],"abstract_inverted_index":{"Security":[0],"programs":[1],"frequently":[2],"treat":[3],"closure":[4,316],"of":[5,31,44,137,156,191,208,250],"a":[6,12,36,60,98,109,164,169,182,197,217,299],"vulnerability":[7,114],"finding":[8,134],"as":[9,33,317],"proof":[10],"that":[11,75,82,91,135,171,238,324],"threat":[13],"has":[14],"been":[15],"removed":[16],"and":[17,70,226,258,293,320,331],"sometimes":[18],"label":[19],"the":[20,27,45,52,80,92,116,122,148,160,255,265,327,333],"work":[21],"preemptive":[22,318],"defense.":[23],"This":[24],"paper":[25,103],"accepts":[26],"narrower":[28],"NIST":[29],"framing":[30],"patching":[32],"preventive":[34],"maintenance:":[35],"successfully":[37],"installed":[38],"fix":[39],"can":[40,284],"prevent":[41],"future":[42],"exploitation":[43,76,202],"particular":[46],"condition":[47],"it":[48],"removes.":[49],"It":[50,72,310],"rejects":[51],"broader":[53],"substitution.":[54],"Vulnerability":[55],"remediation":[56,110,115,334],"begins":[57],"only":[58],"after":[59,332],"defect":[61],"is":[62,88,152,305,311],"found,":[63],"disclosed,":[64],"made":[65],"actionable,":[66],"queued,":[67],"tested,":[68],"deployed,":[69],"verified.":[71],"cannot":[73],"prove":[74],"did":[77],"not":[78,269,306],"precede":[79],"fix,":[81],"persistence":[83],"or":[84,90,144,301],"stolen":[85],"trust":[86],"material":[87],"absent,":[89],"next":[93],"attempt":[94],"will":[95],"depend":[96],"on":[97,143],"patchable":[99,242],"software":[100],"defect.":[101],"The":[102,261,303],"combines":[104],"four":[105],"complementary":[106],"analyses.":[107],"First,":[108],"coverage":[111],"ceiling":[112],"gives":[113],"entire":[117],"31%":[118],"vulnerability-exploitation":[119],"share":[120],"in":[121,175,186,189,206,326],"2026":[123],"Verizon":[124],"DBIR,":[125],"then":[126],"applies":[127],"an":[128,211,222,229,233,271],"illustrative":[129],"timing":[130],"sensitivity":[131,151],"using":[132],"VulnCheck\u2019s":[133],"28.96%":[136],"2025":[138],"known-exploited":[139],"vulnerabilities":[140,178],"were":[141],"exploited":[142],"before":[145],"CVE":[146,243],"publication;":[147],"corresponding":[149],"disclosed-in-time":[150],"22.0%,":[153],"leaving":[154],"78.0%":[155],"initial-access":[157],"classifications":[158],"outside":[159],"modeled":[161,256],"reach.":[162],"Second,":[163],"capacity":[165],"diagnostic":[166],"shows":[167,237],"why":[168],"program":[170],"closes":[172],"roughly":[173],"one":[174],"ten":[176],"open":[177],"per":[179],"month":[180],"carries":[181],"waiting":[183],"time":[184],"measured":[185],"months,":[187],"consistent":[188],"order":[190],"magnitude":[192],"with":[193],"application-security":[194],"measurements.":[195],"Third,":[196],"500,000-trial":[198],"disclosure-race":[199],"model":[200,236],"estimates":[201],"preceding":[203],"verified":[204],"deployment":[205],"49.6%":[207],"trials":[209],"under":[210],"aggressive":[212],"IT":[213,257],"tempo,":[214],"80.4%":[215],"for":[216,221,228],"typical":[218],"enterprise,":[219],"96.5%":[220],"OT":[223,259,295],"quarterly":[224],"window,":[225],"99.1%":[227],"annual":[230],"turnaround.":[231],"Fourth,":[232],"exploratory":[234],"residual-path":[235],"forcing":[239],"every":[240],"known":[241],"closed":[244],"still":[245],"leaves":[246],"37.8%":[247],"to":[248,278,307,312,321],"66.5%":[249],"attempted":[251],"paths":[252],"viable":[253],"across":[254],"postures.":[260],"field":[262],"record":[263],"explains":[264],"residual:":[266],"patches":[267],"do":[268],"evict":[270],"adversary":[272],"already":[273],"present;":[274],"valid":[275],"credentials":[276],"authenticate":[277],"fully":[279],"patched":[280],"systems;":[281],"protocol-legal":[282],"commands":[283],"create":[285],"unsafe":[286],"physical":[287],"outcomes;":[288],"incomplete":[289],"fixes":[290],"produce":[291],"variants;":[292],"some":[294],"advisories":[296],"arrive":[297],"without":[298],"patch":[300,308],"mitigation.":[302],"conclusion":[304],"less.":[309],"stop":[313],"reporting":[314],"named-defect":[315],"defense":[319],"fund":[322],"controls":[323],"remain":[325],"path":[328],"before,":[329],"during,":[330],"lifecycle.":[335]},"counts_by_year":[],"updated_date":"2026-10-07T09:51:55.459714","created_date":"2026-08-27T00:00:00"}