In a recent study released at the Assemble London event on October 14, Chainguard, a software supply chain security firm, unveiled concerning findings regarding vulnerabilities in cybersecurity practices across businesses of varying sizes. The research particularly highlights the alarming differences in how companies with revenue exceeding $1 billion manage high or critical vulnerabilities compared to those with revenues under $250 million.
According to the study, a startling 66% of security leaders from larger companies admitted that they have, at times, left high or critical vulnerabilities unpatched. This figure stands in stark contrast to the 27% of respondents from smaller companies who reported similar practices. This disparity points to a systemic issue that may arise from the complexities and pressures faced by larger organizations.
Chainguard’s research further illustrates that both large and small enterprises encounter unique barriers to effectively addressing these vulnerabilities. For larger corporations, business considerations often overshadow security needs. A significant 46% of leaders cited the prioritization of revenue-generating tasks as a primary obstacle, while 48% expressed concerns regarding the disruptions patching creates within ongoing operations. In contrast, smaller companies grapple primarily with issues related to capacity. About 59% of smaller businesses reported difficulties in effectively testing patches, indicating a lack of resources that prevents them from implementing timely security measures.
To combat these challenges, many organizations have initiated strategic changes. Notably, 51% of survey participants disclosed that their companies have reallocated staff dedicated to vulnerability remediation. Additionally, 40% reported hiring more security professionals, and 39% indicated an increase in engineering personnel to bolster their defenses. Such moves underscore a growing recognition of the importance of robust cybersecurity measures in today’s increasingly complex digital landscape.
Furthermore, businesses are adopting new methodologies to mitigate vulnerability risks. The study found that 50% of respondents are integrating secure-by-default software components into their systems, while 47% are actively working to reduce their dependence on third-party services. Additionally, the frequency of security scans has been ramped up by 42% of organizations, demonstrating an acute awareness of the pressing need to identify vulnerabilities proactively.
Significantly, the role of artificial intelligence (AI) in shaping security operations cannot be overlooked. Almost unanimously, 91% of leaders acknowledged that AI-accelerated attacks have had a profound impact on their roles over the past decade. Many anticipate that within a year, AI-powered tools will routinely outstrip their teams in vulnerability discovery. This expectation highlights the rapid evolution of threats within the cybersecurity landscape, as well as an urgent call for enterprises to adapt quickly.
However, the survey results also reveal a disconcerting level of anxiety among security professionals. A considerable 93% expressed concerns that their organizations cannot respond promptly to AI-driven exploits. This sense of urgency is compounded by reports of burnout among security teams, with 64% of leaders indicating that AI-accelerated attacks have contributed significantly to their fatigue over the past year. Alarmingly, 96% of respondents acknowledged that this burnout adversely affects their organizations’ capacity to defend against AI-related threats, with 54% characterizing the impact as moderate to significant.
The financial implications of securing against AI threats are notable as well. A substantial 70% of respondents affirmed that obtaining budget approval for AI-driven defense measures is relatively straightforward. However, a significant 39% admitted to acquiring tools that remain unused, and only 22% rated their current tools as “very effective.” This raises questions about the alignment between investment and actual security outcomes.
Despite the deployment of advanced tools, many security leaders remain on high alert. Among those confident in their tools’ effectiveness, a surprising 77% still expect to encounter an exploit in the coming year. Furthermore, nearly half (48%) believe that their investments in cybersecurity defenses fall short of the expectations set by boards and executive teams.
The findings of this comprehensive survey, which included feedback from 1,300 cybersecurity leaders across various industries and global markets, were commissioned by Chainguard and conducted online in September 2026 by Wakefield Research. It encompassed organizations with a minimum of 500 employees, ensuring a robust representation of the industry’s landscape.
Overall, this research sheds light on the urgent need for organizations of all sizes to reevaluate their cybersecurity strategies, confront the challenges posed by emerging technologies, and address the lingering vulnerabilities that could expose them to significant risks in an ever-evolving threat landscape.