Research commissioned by software security company Chainguard showed that 66% of security leaders at businesses with revenue of $1 billion or more acknowledged leaving high or critical vulnerabilities unresolved at least sometimes. The corresponding figure was 27% among companies earning less than $250 million, a difference of 39 percentage points.
The findings, published alongside Chainguard’s AI Exploit Gap report at its Assemble London event, suggest that larger budgets and security operations do not necessarily translate into faster remediation. Respondents at major companies identified competing commercial priorities and disruption to business operations as leading obstacles to applying security fixes.
Among security leaders at larger businesses, 48% cited the operational disruption caused by patching, while 46% said revenue-generating work took precedence. Smaller companies reported different constraints, with 59% pointing to difficulties testing patches before deployment.
Across the full survey, 54% of respondents acknowledged that their organisations knowingly leave high or critical vulnerabilities unpatched at least occasionally. The responses reflect executives’ assessments of their companies’ practices rather than independent technical examinations of their systems or verified rates of successful cyberattacks.
Chainguard commissioned Wakefield Research to conduct the online survey in September 2026. It questioned 1,300 cybersecurity leaders at director level or above across Brazil, France, Germany, Japan, Mexico, Saudi Arabia, Singapore, the United Arab Emirates, Britain and the United States.
The study also examined how artificial intelligence is changing the balance between discovering software weaknesses and correcting them. Some 91% of respondents said AI-accelerated attacks had changed their jobs more than any other development during the previous decade.
A further 93% expressed concern that their organisations could not remediate AI-driven exploits quickly enough. More than half expected AI-powered vulnerability discovery to routinely outpace their security teams within a year, indicating anxiety about the time available to investigate, prioritise and resolve identified weaknesses.
Quincy Castro, Chainguard’s chief information security officer, said artificial intelligence had transformed security work faster than other developments over the past decade. He argued that finding flaws more quickly would not necessarily help organisations unless the processes responsible for fixing them could keep pace.
The survey found that 77% of security leaders considered it likely that an attacker would exploit a software vulnerability within their organisation during the next 12 months. That figure represents respondents’ expectations, not a forecast based on observed breaches.
Confidence in existing defences did not eliminate those concerns. Among executives who rated their cybersecurity tools as very effective, 77% still anticipated an exploited vulnerability within a year. A similar proportion of those confident in their incident response capabilities expressed the same expectation.
The study identified a further difference in perceptions of urgency. Among leaders who believed AI already surpassed human remediation capacity, 20% said their organisations sometimes left critical vulnerabilities unpatched. That proportion climbed to 50% among those expecting the change within a year and 64% among those who thought it remained more than a year away. The association does not establish that greater concern alone produces faster patching, but it illustrates how respondents assessed competing operational risks.
Companies have nevertheless begun adjusting their security operations. Some 51% of respondents said they had reassigned employees to vulnerability remediation, while 40% had recruited additional security personnel and 39% had expanded engineering teams.
Half reported adopting software components designed to be secure by default. Another 47% said they had reduced reliance on third-party dependencies, and 42% had increased the frequency of vulnerability scanning.
Spending alone appeared insufficient to address deployment difficulties. Although 70% said obtaining funding for AI-related threat defence was easy, 39% acknowledged purchasing security tools that had not yet been implemented. Only 22% rated their tools as very effective.
Nearly half, or 48%, said their investments still fell short of the protection expected by boards and executive management. Separately, 93% believed senior leaders needed to demonstrate greater urgency in responding to AI-accelerated threats.
The pressure was also affecting employees. Some 64% said AI-related attacks had contributed moderately or greatly to their personal burnout during the previous year. An overwhelming 96% believed security-team burnout affected their organisation’s ability to defend against AI threats to some degree, including 54% who described the effect as moderate or significant.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
