Nearly half of big firms shelve or close vulnerability findings they haven’t confirmed
Nearly half of security teams at organizations with 5,000 or more employees close or deprioritize vulnerability findings without fully verifying them, ProjectDiscovery found, and the reason they give is time.
Here’s the catch. Among teams that skip full verification, 57% say at least three out of four findings they do check turn out to be real. If most of what you look at is genuine, there’s not much reason to think the stuff you didn’t look at is noise. And that stuff isn’t sitting still. Mandiant says attackers took an average of 7 days to exploit a vulnerability in 2025. In 2018, it was 63.
Backlogs are getting bigger
For most teams, the backlog is getting bigger. Three in four say it grew over the past year, and a big share of the new findings now come from AI testing tools. Size makes it worse. Most large enterprises are sitting on more than a thousand untriaged findings, and about a quarter are past ten thousand. Among smaller companies, piles that big are rare.
Plenty of what’s in there is junk. Nearly everyone surveyed says at least one finding in ten turns out to be fake or unexploitable once someone looks at it, and over a third say it’s more than one in four. The trouble is that you can’t tell junk from the real thing just by looking at the list. Someone still has to check each one.
More scanners, less checking
Most teams aren’t working from one list. Seven in ten pull findings from three or more places: scanners, bug bounties, pentests, customer reports. Each source describes the same flaw a little differently, so teams tend to pick one tool as the source of truth, and findings from the others can slip through without anyone reviewing them. The more sources a team juggles, the more corners it cuts. Teams with five or more sources are nearly twice as likely as teams with one or two to close findings without fully verifying them.
Leaders admit it more often
Close to half of everyone surveyed admits to closing or deprioritizing findings they haven’t fully checked, because there isn’t time. What’s interesting is who’s saying it. More than half of security leaders agreed, against about a third of the practitioners. The people who sign off on the risk say it’s being taken more readily than the people doing the triage.
It doesn’t sit well with them, either. Nearly nine in ten teams that cut this corner worry real vulnerabilities are hiding in their backlog. Among everyone else, most worry about it too, though fewer do. And half of all respondents say hiring more people wouldn’t fix it.
AI adds work and takes some away
AI is working both sides of the backlog. Nearly half of respondents say it’s piling more findings on their desks, and more than half expect attackers using AI to reach the issues in their backlog before their own team does. On the other side, just over a third say AI is helping them triage faster, and those teams are less than half as likely to feel bad about their backlog. It’s hard to know which way that runs. Faster triage may be lifting the mood, or the teams already in decent shape may have been the first to bring the tools in.
Download: The IT and security field guide to AI adoption
