A new Chainguard report finds that 66% of security leaders at companies generating more than $1 billion annually admit their organizations knowingly leave high- or critical-severity vulnerabilities unpatched at least sometimes, compared with 27% at companies generating under $250 million.
The survey of 1,300 cybersecurity leaders also found:
- 93% are concerned their organizations cannot remediate AI-driven exploits quickly enough.
- 91% say AI-accelerated attacks have changed their jobs more than anything else in the past decade.
- 77% expect attackers to exploit a software vulnerability at their organization within the next year.
- 54% believe AI-powered vulnerability discovery will routinely outpace human remediation within a year.
Larger organizations cited operational disruption (48%) and competing revenue priorities (46%) as barriers to patching, while smaller companies pointed to difficulties testing patches (59%). Despite increased security spending, only 22% rated their AI defense tools as very effective.
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security Technology Inc.:
“The finding that 66% of billion-dollar companies knowingly leave high- or critical-severity vulnerabilities unpatched is concerning, but an unpatched vulnerability does not automatically mean an exploitable attack path. Severity tells us where to look; offensive validation helps establish what an attacker can accomplish.
“Scanning more frequently is a good thing. I’d rather know where we’re exposed than operate under the illusion that we’re secure. The real challenge is turning those findings into action: prioritizing what matters, fixing what we can, and deploying compensating controls when remediation takes time. Segmentation, deception, and other defensive measures can introduce friction into an attacker’s path, but those controls need to be tested rather than assumed effective.
“Security teams are tired, and the environment isn’t getting any simpler. We cannot patch everything overnight, but we can continuously test our environments, validate attack paths, and verify that our fixes work. A good offense makes for a stronger defense. The goal isn’t simply to find more vulnerabilities; it’s to use that knowledge to reduce meaningful risk.”
John Strand, Owner, Black Hills Information Security:
“This study from Chainguard is going to shock a lot of people. There’s always this assumption that larger organizations have better security than smaller organizations. That’s often not what we see. Larger organizations have a larger attack surface, more people to target through social engineering, and a tremendous amount of legacy technology accumulated over decades.
“Look at banking and finance. Tons of legacy systems. Look at DoD. There are still old SPARC systems floating around because these technologies underpin critical operations. Organizations put together plans of action and milestones for replacing them, but the actual replacement keeps getting pushed into the future. They keep hoping they can layer more and more security on top of old technology and somehow make it secure. That approach has real limits, especially as offensive AI capabilities grow.
“The statistic that absolutely floored me was that, despite increased security spending, only 22% rated their AI defensive tools as very effective. That is concerning. We’re seeing a massive boom in offensive AI capabilities, and some companies are absolutely seeing a return on their investment in defensive AI. But I suspect many of the organizations getting the most benefit have been able to start from scratch and build their infrastructure and workflows around it.
“It’s a lot harder to start slapping AI into existing security tools and workflows than it is to build with it from the beginning. And unfortunately, that 22% figure feels pretty close to the broader struggle we’re seeing across IT to turn AI investment into something that actually works. When offensive capabilities are advancing this quickly, that gap worries me.”
ㅤ
Sharon Hagi, CSO, Finite State:
“The gap is wider than the survey actually sees.
“Chainguard’s “AI Exploit Gap” report thesis is right: AI now finds and chains vulnerabilities faster than humans fix them traditionally. My view, after years running security for public companies and sitting on boards, is that the reality is worse than the survey shows. Four reasons.
1. You cannot hope to fix or patch what you cannot see.
“The report asks leaders what they knowingly leave unpatched. 54% of security leaders say their organization knowingly leaves a high- or critical-severity vulnerability unpatched at least sometimes. That number assumes they know what is in their products. Most do not. Ask a company with a large connected-device portfolio for the exact component inventory and the known vulnerabilities in the firmware it shipped last quarter, including the supplier binaries nobody has source code for. Very few can answer. The report’s own data hints at it: one in ten respondents say they are “not sure / no way to know” if their organization experienced an AI-driven attack within the past 12 months. The known backlog is the visible part. The unknown backlog in shipped binaries is much larger, and no survey I’ve seen recently attempted to measure it.
“The timelines are also IT timelines. If a zero-day exploit were discovered today, only 19% of organizations could patch it within a day. 51% would require 1-3 days. A firmware fix moves through engineering, regression, certification and a customer who must accept the update. For connected IoT/OT devices we’re talking about months not days or weeks, with support obligations of five years or more. Some deployed devices have no update path at all.
“This is the gap Finite State was built to close. We start from the compiled firmware, not the source, so we see what actually shipped, including supplier blobs. On real customer firmware, tens of thousands of raw findings reduced and distilled to a few dozen well correlated, well analyzed one that were exploitable and reachable. Then we connect that shipped reality to design intent and to the evidence regulators ask for, in one governed record. No other vendor in the connected-device space does all of that together.
2. Boards own this, and most do not know it.
“Directors understand their oversight duty for enterprise IT. Few have extended it to the product portfolio. Materiality does not make that distinction. It is about the investor, not about where the code runs. An exploited flaw in a product you shipped to ten thousand customers can trigger recalls, lost contracts, injuries to humans, catastrophic critical infrastructure failures, litigation and disclosure obligations, exactly like a breach of your ERP or SaaS portal. The SEC’s cyber rules are under review in Washington, but no amendment has been proposed or adopted to explicitly exclude the connected products a company manufacturers and maintains for years, and both IT and product operations oversight requirements remain in effect: the four-business-day incident filing and the annual Item 106 description of how the board oversees cyber risk, including product security risk. The oversight duty does not depend on those rules alone. Under Delaware’s Caremark line of cases, a board must make a good-faith effort to oversee mission-critical risk. For a company whose revenue is connected products, product security is mission-critical risk.
“Europe has moved from duty to deadline. The reporting obligations under Art. 14 of the EU Cyber Resilience Act became applicable on 11 September 2026, with a 24-hour early warning for actively exploited vulnerabilities, and these reporting obligations also cover legacy products placed on the EU market before full application of the CRA. On 9 December, the new Product Liability Directive applies to products placed on the market after that date, with software expressly treated as a product under strict liability. A board that cannot see its portfolio’s vulnerabilities cannot meet a 24-hour clock. The report notes that the C-suite is the group least convinced more urgency is needed. That miscalibration is a liability exposure few directors see today.
3. Product security is a discipline, not a side project.
“Over 99% report taking at least one AI-specific action, most commonly reallocating staff (51%). Moving tired people around is not a strategy. 64% of security leaders report their concern about AI-accelerated cyberattacks has contributed noticeably to their own sense of burnout in the past year. Nobody asked manufacturing engineers to “figure out” quality. We built quality systems, ISO 9001, trained people, and audited them. Product security is the same. The standards exist: IEC 62443-4-1, ISO/SAE 21434, NIST’s SSDF, the CRA’s essential requirements. People who have built and run PSIRTs under regulatory scrutiny exist. Handing the program to a talented engineering team that has never done this is a recipe for failure, and burnout is how the failure shows up first. Get qualified leadership for the program. Hire it, or bring in a partner who has done it.
4. AI is the accelerant. It is not the fire department.
“The report cites Anthropic’s April 2026 research on Claude Mythos Preview, in which the model chained several individually minor bugs into a working exploit for full system takeover. That is the threat, and it is why low and medium findings are no longer safe to ignore. On the defense side, only 22% are using AI-powered security tools “extensively”, and 39% have purchased tools they haven’t rolled out yet. The lesson is not “buy more AI.” A model without ground truth produces confident, wrong answers at scale. AI works in product security when it runs on a governed record of what you actually shipped, with reachability analysis, and with expert review on the decisions that matter. Do not ask a chatbot to design your product security program. You would not let it design your product, your go-to-market or your governance either. It is a force multiplier for the people and the system you already have. Get the people and the system first.
“The gap is real. It is wider than this survey can see, because surveys measure what people know or can expressed as a choice from multiple choices presented. The work is to see what you shipped, own it at board level, staff it with people who have done it, and then let AI make them faster.”
ㅤOrganizations need to realize that a multi layered approach that includes patching helps to keep them safe. Whether they actually do it is another question entirely.
Related
This entry was posted on October 15, 2026 at 8:39 am and is filed under Commentary with tags Chainguard. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
66% of billion-dollar companies knowingly leave critical vulnerabilities unpatched
A new Chainguard report finds that 66% of security leaders at companies generating more than $1 billion annually admit their organizations knowingly leave high- or critical-severity vulnerabilities unpatched at least sometimes, compared with 27% at companies generating under $250 million.
The survey of 1,300 cybersecurity leaders also found:
Larger organizations cited operational disruption (48%) and competing revenue priorities (46%) as barriers to patching, while smaller companies pointed to difficulties testing patches (59%). Despite increased security spending, only 22% rated their AI defense tools as very effective.
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security Technology Inc.:
“The finding that 66% of billion-dollar companies knowingly leave high- or critical-severity vulnerabilities unpatched is concerning, but an unpatched vulnerability does not automatically mean an exploitable attack path. Severity tells us where to look; offensive validation helps establish what an attacker can accomplish.
“Scanning more frequently is a good thing. I’d rather know where we’re exposed than operate under the illusion that we’re secure. The real challenge is turning those findings into action: prioritizing what matters, fixing what we can, and deploying compensating controls when remediation takes time. Segmentation, deception, and other defensive measures can introduce friction into an attacker’s path, but those controls need to be tested rather than assumed effective.
“Security teams are tired, and the environment isn’t getting any simpler. We cannot patch everything overnight, but we can continuously test our environments, validate attack paths, and verify that our fixes work. A good offense makes for a stronger defense. The goal isn’t simply to find more vulnerabilities; it’s to use that knowledge to reduce meaningful risk.”
John Strand, Owner, Black Hills Information Security:
“This study from Chainguard is going to shock a lot of people. There’s always this assumption that larger organizations have better security than smaller organizations. That’s often not what we see. Larger organizations have a larger attack surface, more people to target through social engineering, and a tremendous amount of legacy technology accumulated over decades.
“Look at banking and finance. Tons of legacy systems. Look at DoD. There are still old SPARC systems floating around because these technologies underpin critical operations. Organizations put together plans of action and milestones for replacing them, but the actual replacement keeps getting pushed into the future. They keep hoping they can layer more and more security on top of old technology and somehow make it secure. That approach has real limits, especially as offensive AI capabilities grow.
“The statistic that absolutely floored me was that, despite increased security spending, only 22% rated their AI defensive tools as very effective. That is concerning. We’re seeing a massive boom in offensive AI capabilities, and some companies are absolutely seeing a return on their investment in defensive AI. But I suspect many of the organizations getting the most benefit have been able to start from scratch and build their infrastructure and workflows around it.
“It’s a lot harder to start slapping AI into existing security tools and workflows than it is to build with it from the beginning. And unfortunately, that 22% figure feels pretty close to the broader struggle we’re seeing across IT to turn AI investment into something that actually works. When offensive capabilities are advancing this quickly, that gap worries me.”
ㅤ
Sharon Hagi, CSO, Finite State:
“The gap is wider than the survey actually sees.
“Chainguard’s “AI Exploit Gap” report thesis is right: AI now finds and chains vulnerabilities faster than humans fix them traditionally. My view, after years running security for public companies and sitting on boards, is that the reality is worse than the survey shows. Four reasons.
1. You cannot hope to fix or patch what you cannot see.
“The report asks leaders what they knowingly leave unpatched. 54% of security leaders say their organization knowingly leaves a high- or critical-severity vulnerability unpatched at least sometimes. That number assumes they know what is in their products. Most do not. Ask a company with a large connected-device portfolio for the exact component inventory and the known vulnerabilities in the firmware it shipped last quarter, including the supplier binaries nobody has source code for. Very few can answer. The report’s own data hints at it: one in ten respondents say they are “not sure / no way to know” if their organization experienced an AI-driven attack within the past 12 months. The known backlog is the visible part. The unknown backlog in shipped binaries is much larger, and no survey I’ve seen recently attempted to measure it.
“The timelines are also IT timelines. If a zero-day exploit were discovered today, only 19% of organizations could patch it within a day. 51% would require 1-3 days. A firmware fix moves through engineering, regression, certification and a customer who must accept the update. For connected IoT/OT devices we’re talking about months not days or weeks, with support obligations of five years or more. Some deployed devices have no update path at all.
“This is the gap Finite State was built to close. We start from the compiled firmware, not the source, so we see what actually shipped, including supplier blobs. On real customer firmware, tens of thousands of raw findings reduced and distilled to a few dozen well correlated, well analyzed one that were exploitable and reachable. Then we connect that shipped reality to design intent and to the evidence regulators ask for, in one governed record. No other vendor in the connected-device space does all of that together.
2. Boards own this, and most do not know it.
“Directors understand their oversight duty for enterprise IT. Few have extended it to the product portfolio. Materiality does not make that distinction. It is about the investor, not about where the code runs. An exploited flaw in a product you shipped to ten thousand customers can trigger recalls, lost contracts, injuries to humans, catastrophic critical infrastructure failures, litigation and disclosure obligations, exactly like a breach of your ERP or SaaS portal. The SEC’s cyber rules are under review in Washington, but no amendment has been proposed or adopted to explicitly exclude the connected products a company manufacturers and maintains for years, and both IT and product operations oversight requirements remain in effect: the four-business-day incident filing and the annual Item 106 description of how the board oversees cyber risk, including product security risk. The oversight duty does not depend on those rules alone. Under Delaware’s Caremark line of cases, a board must make a good-faith effort to oversee mission-critical risk. For a company whose revenue is connected products, product security is mission-critical risk.
“Europe has moved from duty to deadline. The reporting obligations under Art. 14 of the EU Cyber Resilience Act became applicable on 11 September 2026, with a 24-hour early warning for actively exploited vulnerabilities, and these reporting obligations also cover legacy products placed on the EU market before full application of the CRA. On 9 December, the new Product Liability Directive applies to products placed on the market after that date, with software expressly treated as a product under strict liability. A board that cannot see its portfolio’s vulnerabilities cannot meet a 24-hour clock. The report notes that the C-suite is the group least convinced more urgency is needed. That miscalibration is a liability exposure few directors see today.
3. Product security is a discipline, not a side project.
“Over 99% report taking at least one AI-specific action, most commonly reallocating staff (51%). Moving tired people around is not a strategy. 64% of security leaders report their concern about AI-accelerated cyberattacks has contributed noticeably to their own sense of burnout in the past year. Nobody asked manufacturing engineers to “figure out” quality. We built quality systems, ISO 9001, trained people, and audited them. Product security is the same. The standards exist: IEC 62443-4-1, ISO/SAE 21434, NIST’s SSDF, the CRA’s essential requirements. People who have built and run PSIRTs under regulatory scrutiny exist. Handing the program to a talented engineering team that has never done this is a recipe for failure, and burnout is how the failure shows up first. Get qualified leadership for the program. Hire it, or bring in a partner who has done it.
4. AI is the accelerant. It is not the fire department.
“The report cites Anthropic’s April 2026 research on Claude Mythos Preview, in which the model chained several individually minor bugs into a working exploit for full system takeover. That is the threat, and it is why low and medium findings are no longer safe to ignore. On the defense side, only 22% are using AI-powered security tools “extensively”, and 39% have purchased tools they haven’t rolled out yet. The lesson is not “buy more AI.” A model without ground truth produces confident, wrong answers at scale. AI works in product security when it runs on a governed record of what you actually shipped, with reachability analysis, and with expert review on the decisions that matter. Do not ask a chatbot to design your product security program. You would not let it design your product, your go-to-market or your governance either. It is a force multiplier for the people and the system you already have. Get the people and the system first.
“The gap is real. It is wider than this survey can see, because surveys measure what people know or can expressed as a choice from multiple choices presented. The work is to see what you shipped, own it at board level, staff it with people who have done it, and then let AI make them faster.”
ㅤOrganizations need to realize that a multi layered approach that includes patching helps to keep them safe. Whether they actually do it is another question entirely.
Share this:
Like this:
Related
This entry was posted on October 15, 2026 at 8:39 am and is filed under Commentary with tags Chainguard. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.