Kirkland, Wash. – October 14, 2026 -- Seventy-seven percent of security leaders expect an attacker to exploit a software vulnerability at their organization within 12 months, while 54% admit their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes, according to a Chainguard report surveying 1,300 security leaders.
The report, titled The AI Exploit Gap, measures the distance between how fast AI-powered tools can find and chain vulnerabilities and how fast human teams can fix them. Ninety-one percent of respondents say AI-accelerated attacks have changed their job more than anything else in the past decade. Ninety-three percent worry their companies cannot remediate AI-driven exploits quickly enough.
Confidence in tools does not lower expected exposure
Among respondents who rated their cybersecurity tools as very effective, 77% still expect an exploit within a year. The figure is 78% among leaders who consider their incident response teams very equipped for AI-driven attacks, and 77% among those who say investments have stayed ahead of the threat.
Only 22% rate their tools as very effective. Thirty-nine percent have bought tools they have not rolled out, and 48% say investments fall short of what boards and executive teams expect. Seventy percent say securing budget for AI-driven threat defense is easy.
Companies above $1 billion in revenue leave critical flaws unpatched at over twice the rate of smaller peers
Sixty-six percent of companies with $1 billion or more in revenue say they leave high or critical vulnerabilities unpatched at least sometimes, versus 27% of companies under $250 million. Larger firms cite patching being too disruptive to operations (48%) and revenue-generating work taking priority (46%). Smaller firms point to capacity limits, with 59% citing difficulty testing patches.
Perceived urgency tracks exposure. Among leaders who believe AI already outpaces human remediation, 20% say critical vulnerabilities go unpatched at least sometimes. The share rises to 50% among those expecting that shift within a year and 64% among those who see it more than a year away. More than half expect AI-powered discovery to routinely outpace their teams within a year.
Burnout hits 64% of security leaders as regulation raises the cost of known flaws
Sixty-four percent say concern about AI-accelerated attacks contributed moderately or greatly to their own burnout in the past year. Ninety-six percent say team burnout affects their organization's ability to defend against AI threats, and 54% rate that impact as moderate or significant. The EU Cyber Resilience Act and Product Liability Directive add pressure by raising the cost of leaving known vulnerabilities open.
Half of teams have reallocated staff to remediation
Fifty-one percent have reallocated staff to vulnerability remediation, 50% have adopted secure-by-default software components, 47% have reduced third-party dependencies and 42% have increased scanning frequency. Forty percent have hired additional security staff and 39% have added engineering staff. Ninety-three percent believe senior leaders need to show greater urgency on AI-accelerated threats.
Quincy Castro, Chief Information Security Officer at Chainguard, said patching faster is not viable for most organizations and will consume growing resources, and argued that engineering and security must jointly make prevention the standard.
Wakefield Research conducted the survey for Chainguard in September 2026 across nine markets: the U.S., U.K., France, Germany, Brazil, Singapore, Mexico, UAE/Saudi Arabia and Japan. All respondents held at least Director seniority at companies with 500 or more employees, or 250 or more in Singapore and UAE/Saudi Arabia.