“66% of security leaders working in companies with $1bn or more in revenue admitted leaving high or critical vulnerabilities unpatched ‘at least sometimes,’” Chainguard reported on October 14, 2026 — a finding that the company says marks a stark divergence between large and small firms in how they manage known risk.
Large companies: business trade‑offs and operational disruption
Chainguard’s survey of 1,300 senior cybersecurity leaders found that firms with more than $1bn in revenue are more than twice as likely as those under $250m to acknowledge knowingly leaving high or critical vulnerabilities unpatched — 66% versus 27%. Larger organizations pointed explicitly to business trade‑offs as the primary drivers of that choice: 46% said revenue‑generating work takes priority, and 48% said patching is too disruptive to operations.
Those figures portray a conscious, calculated acceptance of technical risk where the cost of remediation is weighed against immediate commercial impact. The survey does not quantify the types of vulnerabilities left unpatched, but the prevalence of the admitted practice in large firms is clear in Chainguard’s findings.
Smaller firms: testing capacity and resource limits
By contrast, smaller respondents — defined in the report as companies generating under $250m in revenue — flagged capacity constraints as the main barrier. Chainguard reported that 59% of these smaller organizations cited difficulty testing patches as a principal challenge.
Where large companies point to prioritization decisions and disruption risk, smaller firms face operational bottlenecks: limited staff time, testing environments and engineering capacity to validate and deploy fixes safely. Those constraints help explain why 27% of smaller firms still report knowingly leaving high or critical vulnerabilities unpatched at least sometimes.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogAI-accelerated attacks: reshaping jobs and driving urgency
The report finds near‑universal agreement that artificial intelligence is altering the vulnerability and patching landscape. Nine in ten respondents (91%) said AI‑accelerated attacks have changed their job more than anything else in the past decade, and more than half expect AI‑powered vulnerability discovery to routinely outpace their teams within a year.
Alarm is widespread: 93% of surveyed leaders expressed concern that their companies cannot remediate AI‑driven exploits quickly enough, and the same share said senior leaders need to show greater urgency in addressing AI‑accelerated threats. The human cost is evident too — 64% said AI‑accelerated attacks contributed moderately or greatly to their own burnout in the past year, and 96% said security‑team burnout has some impact on their organization’s ability to defend against AI threats (54% describing that impact as moderate or significant).
Organizational responses: staffing, tooling and architectural shifts
Organizations are changing how they respond. According to Chainguard, 51% of respondents have reallocated staff to vulnerability remediation, 40% have hired additional security staff, and 39% have added engineering staff. Architectural and process changes include adopting secure‑by‑default software components (50%), reducing third‑party dependencies (47%) and increasing scanning frequency (42%).
Yet the tools picture is uneven. Seventy percent said securing budget for AI‑driven threat defense is easy, but 39% acknowledged they have purchased tools they have not rolled out. Only 22% rate their tools as “very effective,” and even among that group 77% still expect an exploit in the next year. Nearly half (48%) said their investments still fall short of what boards and executive teams expect.
What this means for technologists, policymakers, and enterprise executives
- Technologists and security teams: Chainguard’s respondents are reallocating staff and hiring more specialists, while also shifting toward secure‑by‑default components and reduced third‑party dependencies. Those operational moves respond directly to capacity constraints and the accelerating pace of AI‑driven discovery.
- Policymakers and regulators: The survey’s finding that 93% of security leaders believe senior leaders must show greater urgency highlights a governance gap that public authorities and oversight bodies may monitor, particularly where remediation delays affect critical infrastructure or widely‑used software.
- Enterprise executives and procurement leaders: Boards should note that although securing budget for AI defenses is often straightforward (70%), nearly half of respondents believe current investments fail to meet executive expectations — and 39% have not yet deployed purchased tools.
Chainguard’s September 2026 Wakefield Research survey — covering ten markets (Brazil, France, Germany, Japan, Mexico, the UAE, the UK, the US, Saudi Arabia and Singapore) and 1,300 director‑level and above cybersecurity leaders — paints a simple, uncomfortable picture: bigger organizations are more likely to accept known, serious risk for commercial reasons, while smaller ones struggle with capacity to act; across the board, AI is compressing the time between discovery and exploitation and heightening both urgency and burnout. The core question the data leaves open is operational: will senior leaders accelerate remediation and deployment, or will the trade‑offs that Chainguard documents become the new norm?
