In 2025, network infrastructure critical vulnerabilities increased 235%.

The median time for full resolution of critical vulnerabilities went up to 43 days, almost two weeks more than the previous year’s 32 days.

Only 26% of critical vulnerabilities were fully remediated by organizations in 2025, a drop from the previous year’s 38%.

Routers account for one-third of the most critical vulnerabilities in organizational networks.

Over 77% of organizations leave high or critical container vulnerabilities unpatched for more than 90 days.

60% of organizations with security debt have security debt defined as "critical," representing vulnerabilities severe enough to cause catastrophic damage if exploited.

54% of organizations using at least four compliance controls remediate critical vulnerabilities within a day.

49% of organizations using at least three compliance controls remediate critical vulnerabilities within a day.

APIs in technology & SaaS providers' environments saw a 400% spike in critical vulnerabilities.