Chainguard survey: $1bn+ firms twice as likely as small firms to knowingly leave critical flaws unpatched
A Chainguard survey released at its Assemble London event on October 14 found that 66% of security leaders at companies with $1bn or more in revenue admit leaving high or critical vulnerabilities unpatched "at least sometimes". Among companies with under $250m in revenue, the figure was 27%. Larger firms cite business trade-offs: disruption to operations (48%) and revenue-generating work taking priority (46%). Smaller firms cite capacity constraints, chiefly difficulty testing patches (59%). Respondents also report that AI-accelerated attacks are changing their work and contributing to burnout, and that they doubt their ability to remediate AI-driven exploits quickly enough.
Detalhes técnicos
- 91% say AI-accelerated attacks have changed their job more than anything else in the past decade. More than half expect AI-powered vulnerability discovery to routinely outpace their teams within a year.
- 93% worry their companies cannot remediate AI-driven exploits quickly enough, and the same share believe senior leaders need to show more urgency.
- 64% say AI-accelerated attacks contributed moderately or greatly to their own burnout. 96% say team burnout affects their ability to defend against AI threats.
- 70% say securing budget for AI-driven threat defense is easy, but 39% have bought tools they have not rolled out and only 22% rate their tools as "very effective". Even among that 22%, 77% still expect an exploit in the next year.
- Methodology: 1,300 cybersecurity leaders (director level or above) at companies with at least 500 employees (250 in Singapore, UAE and Saudi Arabia). Wakefield Research ran the survey online in September 2026 across 10 markets, commissioned by Chainguard.
Remediação
Organizations reported the following responses:
- 51% reallocated staff to vulnerability remediation, 40% hired security staff and 39% added engineering staff.
- 50% adopted secure-by-default software components, 47% reduced third-party dependencies and 42% increased scanning frequency.
Linha do tempo
-
Chainguard survey: $1bn+ firms twice as likely as small firms to knowingly leave critical flaws unpatched
ler a análise desta fonte ocultar
A Chainguard survey released at its Assemble London event on October 14 found that 66% of security leaders at companies with $1bn or more in revenue admit leaving high or critical vulnerabilities unpatched "at least sometimes". Among companies with under $250m in revenue, the figure was 27%. Larger firms cite business trade-offs: disruption to operations (48%) and revenue-generating work taking priority (46%). Smaller firms cite capacity constraints, chiefly difficulty testing patches (59%). Respondents also report that AI-accelerated attacks are changing their work and contributing to burnout, and that they doubt their ability to remediate AI-driven exploits quickly enough.
Technical Details
- 91% say AI-accelerated attacks have changed their job more than anything else in the past decade. More than half expect AI-powered vulnerability discovery to routinely outpace their teams within a year.
- 93% worry their companies cannot remediate AI-driven exploits quickly enough, and the same share believe senior leaders need to show more urgency.
- 64% say AI-accelerated attacks contributed moderately or greatly to their own burnout. 96% say team burnout affects their ability to defend against AI threats.
- 70% say securing budget for AI-driven threat defense is easy, but 39% have bought tools they have not rolled out and only 22% rate their tools as "very effective". Even among that 22%, 77% still expect an exploit in the next year.
- Methodology: 1,300 cybersecurity leaders (director level or above) at companies with at least 500 employees (250 in Singapore, UAE and Saudi Arabia). Wakefield Research ran the survey online in September 2026 across 10 markets, commissioned by Chainguard.
Remediation
Organizations reported the following responses:
- 51% reallocated staff to vulnerability remediation, 40% hired security staff and 39% added engineering staff.
- 50% adopted secure-by-default software components, 47% reduced third-party dependencies and 42% increased scanning frequency.