Chainguard

59% of companies with under $250 million in revenue say difficulty testing patches is a barrier to patching.

51% of organizations have reallocated staff to vulnerability remediation.

39% of security leaders say their organizations have bought tools they have not rolled out.

48% of companies with $1 billion or more in revenue say patching is too disruptive to operations.

77% of security leaders expect an attacker to exploit a software vulnerability at their organization within the next 12 months.

20% of security leaders who believe AI already outpaces human remediation say their organizations leave critical vulnerabilities unpatched at least sometimes.

50% of security leaders who expect AI to outpace remediation within a year say their organizations leave critical vulnerabilities unpatched at least sometimes.

64% of security leaders who believe the shift to AI outpacing remediation is more than a year away say their organizations leave critical vulnerabilities unpatched at least sometimes.

50% of organizations have adopted secure-by-default software components.

91% of security leaders say AI-accelerated attacks have changed their job more than anything else in the past decade.

64% of security leaders say concern about AI-accelerated attacks contributed moderately or greatly to their own burnout in the past year.

96% of security leaders say security-team burnout has some impact on their organization's ability to defend against AI-accelerated threats.

54% of security leaders describe security-team burnout's impact on defense ability as moderate or significant.

93% of security leaders express concern that their companies cannot remediate AI-driven exploits quickly enough.

Companies with $1 billion or more in revenue leave high or critical vulnerabilities unpatched at more than twice the rate of companies with under $250 million in revenue (66% vs. 27% do so at least sometimes).

46% of companies with $1 billion or more in revenue say revenue-generating work taking priority is a barrier to patching.

42% of organizations have increased scanning frequency.

40% of organizations have hired additional security staff.

39% of organizations have added engineering staff.

70% of security leaders say securing budget for AI-driven threat defense is easy.

22% of security leaders rate their cybersecurity tools as very effective.

77% of security leaders who rate their cybersecurity tools as very effective still expect an attacker to exploit a vulnerability at their organization within the next 12 months.

48% of security leaders say their investments still fall short of the protection boards and executive teams expect.

93% of security leaders believe senior leaders need to show greater urgency in addressing AI-accelerated threats.

47% of organizations have reduced third-party dependencies.

54% of security leaders say their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes.