VCRI's first quarterly State of Supply Chain report is published. We called it Two Clocks, because the central finding is about timing: the moment a component becomes dangerous, and the moment the rest of us are told. Those two clocks have come apart.
That is not a metaphor. It is two independent measurements of the same gap, taken from opposite sides of the system, that landed on the same number:
Seal Security measured the gap between a fix being committed and an advisory being published: a median of 11 days — and a 167-day tail for Maven. GreyNoise measured a completely different signal — the gap between an exploit-scan surge and the advisory — and got the same 11 days, with 28.96% of 2025 KEVs exploited on or before the day they were published.
Two research teams, two different sides of the supply chain, one conclusion: the advisory is the lagging indicator. If your vendor-risk program waits for the CVE, it is structurally late — and AI economics are widening the gap on the attacker's side, not the defender's (see the companion piece, Three Eras of Zero-Day Economics).
Why this is a VCRI report and not just a blog post
This is the thesis the Institute is built on: point-in-time, self-reported vendor data cannot see the window between the two clocks. You need continuous, observable signal — abandonment on one side, compromise on the other — measured against a transparent, criticizable rule set. That is what VCRI exists to provide, and the quarterly report is where we show our work in public.
Read it
The full Q2 2026 report is print-ready and citable, with the data, the companion resources, and the roadmap to Q3 (publishing early August 2026).
State of Supply Chain — Q2 2026: Two Clocks
While you're here: the VCRI Reference Scorer is open and free — assess any vendor (or your own program) across People, Process, Technology, Data, Facilities, and AI, with a transparent, auditable grade.