Intruder
Reports
All Statistics
92% of security and engineering leaders have tried or adopted AI pentesting.
47% of organizations go more than a month between full pentests on their web applications and APIs.
40% of security and engineering leaders cite data privacy as a top barrier to AI pentesting.
More than two-thirds of organizations operate multi-cloud environments.
87% of AWS S3 buckets do not enforce HTTPS.
84% of AWS accounts have permissive ingress to sensitive ports.
26% of organizations leave MySQL databases exposed to the internet.
More than 1 in 7 organizations expose API documentation to the internet.
Midmarket organizations average 56 days to remove exposures, nearly four times slower than smaller enterprises.
51% of midmarker security leaders say it would take approximately a week to assess their exposure to a critical zero-day.
38% of midmarket security leaders say their digital estate grew significantly over the past 24 months.
44% of midmarket organizations describe a stack that is either outgrown or fragmented.
Nine in 10 security and engineering leaders consider the traditional annual pentest obsolete and require continuous AI pentesting to keep pace with how quickly organizations ship code.
42% of security and engineering leaders accept the risk and ship code without additional security checks between pentests.
36% of security and engineering leaders cite safety on production systems as a top barrier to AI pentesting.
25% of security and engineering leaders name the depth of AI testing compared with human testers as a top barrier.
68% of organizations deploy code at least daily.
37% of organizations deploy code multiple times a day.
Among leaders running scheduled pentests, 88% worry about unmapped risk introduced between tests.
56% of organizations spend six hours or more per week triaging, validating, or dismissing false positives and non-exploitable findings.
21% of organizations spend 11 hours or more per week triaging, validating, or dismissing false positives and non-exploitable findings.
Fewer than two in five organizations independently retest a fix in production as soon as it ships.
55% of organizations use AI pentesting across their environment.
28% of security and engineering leaders question whether auditors and regulators will accept AI-generated reports.
25% of security and engineering leaders say a lack of visibility into what was tested would most damage their trust in AI pentesting.
21% of security and engineering leaders say a lack of reproducible proof of exploitability would most damage their trust in AI pentesting.
Only 4% of security and engineering leaders say their testing frequency gives them sufficient coverage.
Only 1% of organizations test on every major release.
55% of Azure accounts contain Entra users without multifactor authentication (MFA).
76% of AWS accounts have publicly exposed services, compared to 64% of Azure accounts and 8% of Google Cloud accounts.
Organizations with 1,000–5,000 employees take 35 days to remediate cloud issues.
Weak IAM controls affect 87% to 97% of accounts across AWS, Azure, and Google Cloud.
75% of Google Cloud accounts are missing OS Login controls.
IAM weaknesses occur in 87% of SMEs, 95% of midmarket organizations, and 98% of large enterprises.
AWS leads in prevalence across five of the six misconfiguration categories.
83% of AWS accounts have IAM policies that allow privilege escalation.
Smaller organizations remediate cloud issues in 8 to 16 days.
Azure's top three misconfigurations affect between 61% and 67% of Azure accounts.
Permissive firewalls affect 83% of AWS accounts, 45% of Azure accounts, and 34% of Google Cloud accounts.
Organizations with 10,000+ employees remediate cloud issues in 10 days.
15% of organizations leave WordPress admin panels internet-facing.
Organizations with over 5,000 employees manage almost 35 times more external assets than small enterprises with 51–250 employees.
8% of organizations leave phpMyAdmin internet-facing.
8% of organizations expose UPnP on the public internet.
9% of organizations expose SNMP on the public internet.
49% of organizations expose risky ports and services.
Retail firms average 10 days to remediate exposures.
Small organizations remediate vulnerabilities fastest, averaging 14–18 days to fix exposures.
Organizations in the 5,000–10,000 employee range average 56 days to remediate exposures.
Banks remediate exposures in 11 days on average.