1 in 5 organizations take four or more days to fix critical vulnerabilities.

Nearly 40% of organizations still rely on manual workflows for most of their vulnerability remediation processes.

54% measure success of vulnerability remediation by fewer breaches.

49% measure success of vulnerability remediation by mean time to remediation.

91% of organizations experience delays in vulnerability remediation.

57% of organisations resolve at least 90% of their serious findings in pentests.

Larger organisations take over a month longer (61 days) than smaller ones (27 days) to resolve serious findings in pentests.

46% of companies commit to fix critical vulnerabilities within just three days.

15% of organisations resolve 10% or less of their serious findings in pentests.

69% of the highest-risk (serious) vulnerabilities are resolved.

The rate for serious findings in pentests being resolved in each calendar year remains stuck at just 55%.

Since 2017, the median time to resolve serious vulnerabilities has decreased dramatically—from 112 days down to 37 days last year.

Less than half (48%) of vulnerabilities are remediated.

Financial companies have a lower rate of serious findings (11%) in pentests.

Median time to resolve issues of all criticalities stretches to 67 days.

This represents a cut of 75 days, or two-thirds.

Small companies lead with 81% of serious findings in pentests resolved.

Large organisations resolve only 60% of serious pentest findings.

Only 18% use AI to bolster vulnerability remediation workflows