How it works: the server records when the defence first recognised an attempt to use a CVE and takes the publication date from an open database. Not every vulnerability is recognised, so the real first attempt may have been earlier.
ogurexxx@root:~$ watch -n1 cve
Exploit speed
When a new vulnerability is published, a clock starts for administrators. This page shows how long they really have: from CVE publication to the first attempt on this server.
New vulnerabilities
No vulnerability has been both published and tried during the observation so far. These numbers are rare, which makes them valuable.