“The mean time to exploit a software vulnerability has dropped to minus seven days, meaning exploits often occur before a patch is released.”