GET /v1/statistics/delays

Three delays measured across the entire CVE database, in days. These are the indicators that answer “how much time do I have before a vulnerability is exploited”.

Required scope: stats-global

Request

GET /api/v1/statistics/delays
Authorization: Bearer twa_your_key_here

Query parameters

Parameter	Type	Default	Description
metric	string	kev	kev, disclosure, poc
granularity	string	—	When set (day…year), one set of percentiles per bucket instead of a single global one
period	string	—	2026, 2026-Q1, 2026-03, 2026-W12, 2026-03-15
from / to	date	—	Explicit bounds, ignored when period is set

The window always applies to the CVE’s publication date, whatever the metric.

The three metrics

metric	Measures	How to read it
kev	Publication → added to the CISA KEV catalog	Time before exploitation is observed in the wild
disclosure	Identifier reserved → published	Disclosure latency, between reservation and actual publication
poc	Publication → first known public PoC	The window before exploit code circulates

Response 200 OK

Without granularity:

{
  "metric": "kev",
  "unit": "days",
  "granularity": null,
  "from": "2020-01-01",
  "to": "2026-09-11",
  "overall": {
    "count": 842,
    "avg": 187.4,
    "min": -12,
    "max": 3921,
    "p50": 41.0,
    "p90": 612.0,
    "p99": 2447.0
  }
}

With granularity, the overall block is replaced by points, one entry per bucket carrying the same fields plus period.

Fields

Field	Type	Description
count	integer	Number of CVEs for which the delay is computable
avg	float	Mean, in days
min max	integer	Observed extremes
p50 p90 p99	float	Median and percentiles

Negative delays are kept

A negative delay is not a data glitch and is not filtered out: a public PoC can predate the CVE’s publication (0-day), and a KEV entry can be backdated. Prefer the median over the mean, which those values pull down.

count is far below the total CVE count: only CVEs that entered the KEV catalog have a kev delay, and only those with a dated PoC have a poc delay.

Errors

Code	Detail	Cause
422	Métrique inconnue…	metric outside kev, disclosure, poc
422	Granularité inconnue…	Value outside the allowed list
422	Période « … » non reconnue	Invalid period format

Example

Median time-to-exploitation, year by year since 2020:

curl -s \
  -H "Authorization: Bearer twa_your_key_here" \
  "https://app.techwatchalert.com/api/v1/statistics/delays?metric=kev&granularity=year&from=2020-01-01" \
  | jq '.points | map({year: .period[0:4], median_days: .p50, sample: .count})'