Website security isn't set-and-forget anymore.

A few years ago, there was usually plenty of time between a security flaw being discovered and someone using it to attack websites. That gap has all but disappeared. Here's what's changed, and why ongoing care is now essential.

More vulnerabilities, exploited faster.

5 hrs

Weighted median time to first exploit for heavily targeted WordPress vulnerabilities in 2025.

Patchstack, 2026
2×

Exploited high and critical-severity vulnerabilities more than doubled in 2025, from 71 to 146.

Rapid7, 2026
6 min

One cybercrime report every six minutes to the Australian Signals Directorate in 2024–25 (84,700+ reports).

ASD, 2025
$56.6k

Average self-reported cost of cybercrime per report for an Australian small business, up 14%.

ASD, 2025

The window between a fix and an attack has all but closed.

Once a security fix is published, attackers study it and start scanning the web for websites that haven't applied it yet. Security firm Rapid7 found that the number of exploited high and critical-severity vulnerabilities more than doubled in 2025 (from 71 to 146), and the median time from disclosure to confirmed exploitation fell from 8.5 days to just five.

For widely targeted website plugins, it's faster still: Patchstack measured a weighted median of five hours to first exploit. A once-a-year update on its own leaves months of exposure. That's why every plan includes monitoring and urgent action between scheduled services.

Cyber Daily on Rapid7 · Patchstack

Your website is built from many moving parts.

Modern websites rely on a content management system plus a collection of plugins, each maintained by a different developer. That's where most of the risk lives: in 2025, 91% of new WordPress vulnerabilities were found in plugins, not the core software.

And fixes don't always arrive on time. Patchstack reports that 46% of vulnerabilities didn't have a fix from the developer by the time they were publicly disclosed. Someone needs to be watching for when a fix does land, and apply it quickly and safely.

Patchstack, State of WordPress Security in 2026

Even well-built platforms need patching.

It isn't only WordPress. In 2025 a maximum-severity (CVSS 10) flaw in Craft CMS, a well-regarded platform, was exploited as a zero-day, compromising hundreds of websites. The US Cybersecurity and Infrastructure Security Agency later added it to its catalogue of known exploited vulnerabilities.

Craft's developers released a fix and contacted licence holders urging them to update. Websites that were updated promptly were protected; those that weren't remained exposed. Good software still depends on good maintenance.

SecurityWeek

No business is too small to be a target.

Most attacks on websites are automated. Bots scan for known weaknesses, whatever the size or profile of the business behind the site. In 2024–25 the Australian Signals Directorate received more than 84,700 cybercrime reports and responded to over 1,200 cyber security incidents, an 11% increase on the year before.

The cost is rising too. The average self-reported cost per report was $56,600 for small businesses (up 14%) and $97,200 for medium businesses (up 55%). Recovery is almost always more expensive, and more disruptive, than prevention.

ASD Annual Cyber Threat Report 2024–25

Protection that keeps pace with the threat.

We watch, so you don't have to

Active monitoring for Critical and High-severity security updates affecting your website platform, between scheduled services.

We act without the back-and-forth

When an urgent security update is needed, we apply it as soon as practicable during business hours, without waiting for approval.

Regular, tested updates

Scheduled services keep your CMS and plugins on compatible, supported versions, with key functionality tested afterwards.

Priority when it counts

During a security incident, Priority Care clients are attended to first, then Plus, then Basic, taking severity and impact into account.

Maintenance significantly reduces risk, but no service can guarantee a website will never be affected. We're upfront about what's covered in our plan terms.

Don't just take our word for it.

Australian Signals Directorate

Annual Cyber Threat Report 2024–25

The Australian Government's overview of the threats facing Australian businesses, including rising costs for small and medium businesses.

Read report → Patchstack

State of WordPress Security in 2026

A record year for website plugin vulnerabilities, and how quickly attackers move once a flaw is known.

Read whitepaper → Cyber Daily

Exploitation timelines dropped, vulnerabilities surged in 2025

Coverage of Rapid7's 2026 Global Threat Landscape Report and the shrinking time to respond.

Read article → SecurityWeek

Craft CMS zero-day exploited to compromise hundreds of websites

How attackers used a critical flaw in a popular CMS, and why prompt updates mattered.

Read article → TechRadar

Average time to exploit has dropped significantly

Flashpoint research showing the grace period to patch has shrunk from years to weeks.

Read article → cyber.gov.au

Cyber security for businesses

Practical guidance from the Australian Cyber Security Centre for protecting your business, including keeping software up to date.

Visit site →

Find the right level of care for your website.

Compare plans →