Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures? I want to understand how long organizations are typically exposed to new malware before a signature is available to them.
Exact information on how long it takes organisations to detect and publish signatures to their AV products will be proprietary and closely guarded by the various AV vendors.
There are number of clues to the general time frame dotted around though. Kim Zetters book Countdown to Zero Day, conducted thorough research to tell the story of stuxnet, in the book she goes into great depth about the workings of the malware industry. In a passage specifically about Symantec she says the following;
"When the company first entered the antivirus business, it was considered a good response time to turn around a threat -from discovery to delivery of signatures- within a week. But Symantec aimed to reduce this to less than a day. To accomplish this the company needed analysts in multiple time zones to spot viruses in the wild when they first appeared and to get signatures out to customers in the US before they woke up and began clicking on malicious e-mail attachments."
So Symantec and I presume their main competitors in the market have a very fast turnaround, when they successfully detect new malware or new strains of malware.
In 2010, which in technology terms may as well be a lifetime ago, there was certain circumstances when at least a week was still possible for signatures to be published to some AV products for known malware.
Kaspersky Lab created 10 harmless files and flagged them to malware aggregators VirusTotal that Kaspersky considered them as malicious.
"Within a week and a half, all 10 files were declared dangerous by as many as 14 security companies that had blindly followed Kaspersky's lead, according to a media presentation given by senior Kaspersky analyst Magnus Kalkuhl in Moscow in January 2010."
Another organisation admitted to conducting a similar experiment 3 years ago, they also quoted a week until they saw signatures being published. So not much had changed from the 2010 experiment, which suggests that the procedures and practices of some AV companies don't change that much over time.
Based on this I would suggest that AV signatures from malware detection to the publishing of a signature could be anywhere between 1 day to 1 week, depending on the AV vendor. Clearly this includes a lot of assumptions though.