HackerOne Report: Backlog of Unresolved Vulnerabilities Up 131% in Two Years
HackerOne's 10th annual Security Research Report found that the backlog of validated, unresolved vulnerabilities grew by 131% in two years. The report centers on what the company calls 'Exposure Debt', the growing gap between what organizations find and what they can fix.
- HackerOne released its 10th annual Security Research Report.
- The backlog of validated, unresolved vulnerabilities grew by 131% in two years.
- HackerOne defines 'Exposure Debt' as the growing gap between what organizations find and what they can fix.
- CEO Kara Sprague will discuss the findings and the impact of AI on cybersecurity on NYSE Live.
What the report found
HackerOne released its 10th annual Security Research Report in the week of October 9, 2026, according to a daily pre-market update from the New York Stock Exchange (NYSE). The headline finding is that the backlog of validated, unresolved vulnerabilities grew by 131% in two years.
The report puts the focus on a concept it calls Exposure Debt. HackerOne defines it as the growing gap between what organizations find and what they can fix. In other words, security teams are identifying vulnerabilities faster than they are able to resolve them, and the unresolved items keep piling up.
Why the Exposure Debt framing matters
The figure refers to vulnerabilities that have been validated, meaning they are confirmed problems and not unverified reports. The growth of that backlog suggests that the bottleneck for many organizations lies in remediation capacity, not only in discovery.
The NYSE summary does not provide further detail on the methodology, the size of the backlog or a breakdown by industry, so those points remain to be seen in the full report.
NYSE Live interview and the AI angle
HackerOne CEO Kara Sprague will appear on NYSE Live to discuss the findings in more depth. According to the NYSE, she will also address the impact of AI across cybersecurity. The source does not say what position she will take on that topic.
The mention came in a broader market update that also covered Zeta Global's Zeta Live '26 event in New York City and its work with Fireworks on the Athena Inference Model, as well as investor attention on the AI trade after a revenue report from OpenAI affected market activity on Thursday.
What it means
For security and engineering teams, the report points to a practical concern: finding more vulnerabilities does not reduce risk unless organizations can also fix them. The 131% rise over two years is the figure HackerOne uses to illustrate how large that gap has become. Further conclusions will depend on the full report and on Sprague's comments on NYSE Live.
