Report by Cobalt
State of Pentesting Report 2025
Key Findings
Larger organisations take over a month longer (61 days) than smaller ones (27 days) to resolve serious findings in pentests.
69% of the highest-risk (serious) vulnerabilities are resolved.
94% of security leaders agree that pentesting is foundational to security.
Median time to resolve issues of all criticalities stretches to 67 days.
Financial companies have a lower rate of serious findings (11%) in pentests.
Less than half (48%) of vulnerabilities are remediated.
98% of organisations are incorporating generative AI technologies into their products.
81% of organisations believe their security posture is strong.
Large organisations resolve only 60% of serious pentest findings.
Most companies set ambitious service-level agreements (SLA) requiring vulnerabilities to be fixed within 14 days.
Since 2017, the median time to resolve serious vulnerabilities has decreased dramatically—from 112 days down to 37 days last year.
The proportion of serious findings in pentests has also declined by about half (from 20% to 11%) over 10 years.
LLM pentests yield the highest proportion of serious vulnerabilities (32%) than any other asset type tested.
Only 66% of organisations are conducting regular security assessments like pentesting on their AI products.
The rate for serious findings in pentests being resolved in each calendar year remains stuck at just 55%.
57% of organisations resolve at least 90% of their serious findings in pentests.
Only 21% of serious vulnerabilities discovered in LLM tests are being resolved.
This represents a cut of 75 days, or two-thirds.
Small companies lead with 81% of serious findings in pentests resolved.
AI and LLM security has emerged as the top concern among security professionals (72%).
46% of companies commit to fix critical vulnerabilities within just three days.
15% of organisations resolve 10% or less of their serious findings in pentests.