Over half of 1,300 surveyed security leaders admit their firms leave known high or critical flaws unpatched
Chainguard's 1,300-leader survey finds 66% at $1bn-plus firms knowingly leave high or critical flaws unpatched at least sometimes, versus 27% under $250m. The all-respondent rate is 54%, LeadDev reported, with testing and disruption the stated blockers.
The Watch · Security desk
66% of security leaders at companies with $1bn or more in revenue say they leave high or critical vulnerabilities unpatched at least sometimes, against 27% at companies under $250m in revenue and 54% across all respondents.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Leaders at firms with $1bn or more revenue | 66% | 2 | |
| Under $250m revenue | 27% | 2 | |
| All respondents | 54% | 5 |
What happened
- Large companies cite operational disruption (48%) and revenue work taking priority (46%) as barriers, while smaller companies cite difficulty testing patches (59%).
- Of those surveyed, 77% expect an attacker to exploit a software vulnerability at their organization within the next 12 months.
- 39% of respondents have bought tools they have not rolled out, and only 22% rate the tools they have as very effective.
- Companies are responding with people: 51% reallocated staff to remediation, 40% hired security staff and 39% added engineering staff.
Why it matters
- What it limits constraint Money is not the blocker respondents report, so a bigger security budget does not by itself shorten the patch queue.
- Who has to decide decision At large companies someone has to decide when a critical patch may jump ahead of revenue work. Hiring testers does not settle that.
- What doesn't add up contradiction Leaders who rate their tools very effective expect an exploit at the same rate as everyone else, so confidence in tooling is not lowering that expectation.
Next story · Security · 2d ago
Chainguard's beta scanner returns malware verdicts on more than 5,000 Go and .NET packagesConfirmed2 publishers
The two write-ups sort the barriers differently. LeadDev calls both sets engineering problems, because a patch that cannot be tested safely or shipped without disruption waits behind the roadmap [20]. Infosecurity Magazine, reporting the same Chainguard data, labels the large-company barriers business trade-offs and the small-company barrier a capacity constraint [21].
In our view the split changes the remedy. A testing backlog responds to staff and tooling. A decision on whether a patch jumps ahead of revenue work belongs to whoever sets the roadmap. Companies at $1bn or more leave these flaws open at about 2.4 times the rate of companies under $250m [17], and they are the ones citing the second kind of barrier [7].
Urgency tracks with the unpatched rate. Among leaders who believe AI already outpaces human remediation, 20% leave critical vulnerabilities unpatched at least sometimes. The share is 50% among those who expect that within a year and 64% among those who put it more than a year away [14], a 44-point spread [18]. LeadDev notes the survey shows a link, not a cause [15].
Chainguard's CISO Quincy Castro said patching faster will not close the gap. "Thinking you'll just patch faster is the Red Queen talking," he said. "Patching faster isn't viable for most folks and it will consume increasing amounts of resources just to keep pace." [12] He wants engineering and security to own the problem together and make prevention the standard [13].
Chainguard commissioned the survey and is a software supply chain security firm [1][6]. Half of respondents say they have adopted secure-by-default components [11]. Neither write-up reports how long flaws stay open or whether adopters leave fewer unpatched.
Wakefield Research ran the questionnaire online in September 2026 across 10 markets, with respondents at director level or above at companies of 500 or more employees, or 250 in Singapore, the UAE and Saudi Arabia [19]. Chainguard released the results on October 14 at its Assemble London event [3].
What to watch
- Whether Chainguard or Wakefield publishes time-to-patch figures, or the unpatched rate among firms that adopted secure-by-default components.
- Whether a repeat survey shows the 66% at $1bn-plus firms moving, since the 77% expecting an exploit are looking at a 12-month window.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption50
- Hype gap+25
- Incentives65
- Confidence55
Perspective Coverage
4 publishers- Builder
- Builder 34%
- Operator
- Operator 62%
- Investor
- Investor 4%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The AI Exploit Gap report, commissioned by Chainguard and conducted by Wakefield Research, surveyed 1,300 security leaders.
- [2]
66% of security leaders at companies with $1bn or more in revenue admitted leaving high or critical vulnerabilities unpatched at least sometimes, against 27% at companies with under $250m in revenue.
- [3]
The study was released during Chainguard's Assemble London event on October 14.
- [4]
77% of security leaders expect an attacker to exploit a software vulnerability at their organization in the next 12 months.
- [5]
54% of respondents say their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes.
- [6]
Chainguard is a software supply chain security firm.
- [7]
Larger companies cited disruption to operations (48%) and revenue-generating work taking priority (46%) as the main patching hurdles; smaller companies cited difficulty testing patches (59%).
- [8]
39% of respondents have bought tools they have not rolled out, and only 22% rate their tools as very effective.
- [9]
Among respondents who rate their tools very effective, 77% still expect an exploit in the next year, the same share as the full sample.
- [10]
51% of respondents have reallocated staff to vulnerability remediation, 40% have hired additional security staff and 39% have added engineering staff.
- [11]
50% of respondents have adopted secure-by-default software components and 47% have reduced third-party dependencies.
- [12]
Chainguard CISO Quincy Castro said patching faster will not close the gap: "Thinking you'll just patch faster is the Red Queen talking," and "Patching faster isn't viable for most folks and it will consume increasing amounts of resources just to keep pace."
- [13]
Castro said the way out is for engineering and security to own the problem together and make prevention the standard.
- [14]
Among leaders who believe AI already outpaces human remediation, 20% leave critical vulnerabilities unpatched at least sometimes; the share is 50% among those who expect it within a year and 64% among those who think the shift is more than a year away.
- [15]
LeadDev notes the survey shows a link between urgency and remediation, not a cause.
- [16]
70% of respondents say securing budget for AI-driven threat defense is easy.
- [17]
Companies with $1bn or more in revenue leave high or critical vulnerabilities unpatched at about 2.4 times the rate of companies under $250m.
- [18]
The spread in the unpatched-critical share between the 20% group and the 64% group is 44 percentage points.
- [19]
The survey was conducted online in September 2026 by Wakefield Research in 10 markets; respondents had a minimum seniority of director and worked for companies with at least 500 employees (250 in Singapore, the UAE and Saudi Arabia).
- [20]
LeadDev argues that the large- and small-company barriers are both engineering problems because a patch that cannot be tested safely, or shipped without disruption, waits behind the roadmap.
- [21]
Infosecurity Magazine describes the larger companies' barriers as business trade-offs and the smaller companies' barrier (testing difficulty) as a capacity constraint.
Sources
4 independent publishers whose own reporting we read for this story.
- chainguard.devThe AI Exploit Gap: How AI is changing security
1 article · October 13, 2026
- infosecurity-magazine.comBillion-Dollar Companies Twice as Likely to Leave Critical Vulnerabilities Unpatched
1 article · October 14, 2026
- The AI exploit gap is engineering’s problem now - LeadDev
leaddev.com
1 article · October 14, 2026
- scworld.comLarge companies more likely to leave critical vulnerabilities unpatched, study finds
1 article · October 15, 2026
Topics and entities
Entities
- Wakefield Research
- Chainguard
- Infosecurity Magazine