Chainguard Survey: 77% of Security Leaders Expect a Vulnerability Exploit Within a Year
Chainguard's new report, The AI Exploit Gap, finds that 77% of 1,300 surveyed security leaders believe an attacker will likely exploit a software vulnerability at their organization within 12 months. At the same time, 54% say their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes.
- Chainguard's The AI Exploit Gap surveyed 1,300 security leaders globally.
- 77% expect an attacker to exploit a vulnerability at their organization within 12 months.
- 54% say their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes.
- 66% of companies with $1 billion or more in revenue vs. 27% of those under $250 million leave such flaws unpatched at least sometimes.
- Chainguard calls for prevention as the standard and shared remediation between engineering and security.
AI is changing the job faster than defenders can respond
Chainguard, which describes itself as the trusted source for open source, released the global report on the widening distance between how quickly AI-powered tools can find and chain vulnerabilities and how quickly human teams can fix them. According to the survey, 91% of security leaders say AI-accelerated attacks have changed their job more than anything else in the past decade.
The company describes a triple threat for security teams: frontier AI models that find vulnerabilities faster than ever, attackers using the same tools to exploit them, and supply chain attacks that bring in risk from outside the organization. Regulations such as the EU Cyber Resilience Act and Product Liability Directive add pressure by raising the cost of leaving known vulnerabilities open, according to the report.
Quincy Castro, Chief Information Security Officer at Chainguard, said: "AI can find and chain flaws in minutes, while fixing them still moves at human speed and competes with product deadlines and uptime." He calls this the AI exploit gap.
Confidence does not translate into lower expectations of attack
The data shows that leaders expect exploitation even when they trust their security programs. Among respondents who rated their cybersecurity tools as very effective, 77% still expected an attacker to exploit a vulnerability in the next year. The same was true for 78% of leaders who considered their incident response teams very equipped to handle AI-driven attacks, and 77% of those who said investments had stayed ahead of the threat.
Other findings from the report:
- Burnout: 64% say concern about AI-accelerated attacks contributed moderately or greatly to their own burnout in the past year. Some 96% say team burnout affects their organization's ability to defend against AI threats to some degree, and 54% describe the impact as moderate or significant.
- Remediation speed: 93% are concerned their companies cannot remediate AI-driven exploits quickly enough. More than half expect AI-powered vulnerability discovery to routinely outpace their teams within a year.
- Company size: Companies with $1 billion or more in revenue leave high or critical vulnerabilities unpatched at more than twice the rate of those under $250 million (66% vs. 27% say they do so at least sometimes).
Larger companies cite business trade-offs, such as revenue-generating work taking priority (46%) and patching being too disruptive to operations (48%). Smaller companies point to capacity limits, such as difficulty testing patches (59%).
Urgency, spending and what teams are doing
Perception of the threat appears linked to exposure. Among leaders who believe AI already outpaces human remediation, 20% say their organizations leave critical vulnerabilities unpatched at least sometimes. That rises to 50% among those who expect it within a year and 64% among those who think the shift is more than a year away.
Teams are adjusting. According to the survey, 51% have reallocated staff to vulnerability remediation, 50% have adopted secure-by-default software components, 47% have reduced third-party dependencies and 42% have increased scanning frequency. In addition, 40% have hired more security staff and 39% more engineering staff.
Money does not appear to be the main obstacle. Some 70% say securing budget for AI-driven threat defense is easy, yet 39% have bought tools they have not rolled out. Only 22% rate their tools "very effective." Nearly half (48%) say investments still fall short of what boards and executive teams expect, and 93% believe senior leaders need to show greater urgency.
What it means for security and engineering teams
Chainguard concludes that security leaders are not short on awareness or budget, but on the ability to act at the speed AI now demands. Castro argues that patching faster is not viable for most organizations and would consume growing resources. The company's proposed way out is to treat prevention as the standard and make remediation a shared responsibility between engineering and security, so fewer vulnerabilities reach production.
The survey was commissioned by Chainguard and conducted by Wakefield Research in September 2026. Respondents were cybersecurity leaders of at least Director seniority at companies with at least 500 employees (250 in Singapore and UAE/Saudi Arabia), across nine markets: the U.S., U.K., France, Germany, Brazil, Singapore, Mexico, UAE/KSA and Japan. As the research was commissioned by a vendor selling hardened open source components, its conclusions reflect the company's own perspective.
