Vulnerability Remediation Is Not Preemptive Defense: A Coverage-Ceiling, Disclosure-Race, and Residual-Exposure Model for IT and Operational Technology

Security programs frequently treat closure of a vulnerability finding as proof that a threat has been removed and sometimes label the work preemptive defense. This paper accepts the narrower NIST framing of patching as preventive maintenance: a successfully installed fix can prevent future exploitation of the particular condition it removes. It rejects the broader substitution. Vulnerability remediation begins only after a defect is found, disclosed, made actionable, queued, tested, deployed, and verified. It cannot prove that exploitation did not precede the fix, that persistence or stolen trust material is absent, or that the next attempt will depend on a patchable software defect. The paper combines four complementary analyses. First, a remediation coverage ceiling gives vulnerability remediation the entire 31% vulnerability-exploitation share in the 2026 Verizon DBIR, then applies an illustrative timing sensitivity using VulnCheck’s finding that 28.96% of 2025 known-exploited vulnerabilities were exploited on or before CVE publication; the corresponding disclosed-in-time sensitivity is 22.0%, leaving 78.0% of initial-access classifications outside the modeled reach. Second, a capacity diagnostic shows why a program that closes roughly one in ten open vulnerabilities per month carries a waiting time measured in months, consistent in order of magnitude with application-security measurements. Third, a 500,000-trial disclosure-race model estimates exploitation preceding verified deployment in 49.6% of trials under an aggressive IT tempo, 80.4% for a typical enterprise, 96.5% for an OT quarterly window, and 99.1% for an annual turnaround. Fourth, an exploratory residual-path model shows that forcing every known patchable CVE closed still leaves 37.8% to 66.5% of attempted paths viable across the modeled IT and OT postures. The field record explains the residual: patches do not evict an adversary already present; valid credentials authenticate to fully patched systems; protocol-legal commands can create unsafe physical outcomes; incomplete fixes produce variants; and some OT advisories arrive without a patch or mitigation. The conclusion is not to patch less. It is to stop reporting named-defect closure as preemptive defense and to fund controls that remain in the path before, during, and after the remediation lifecycle.