Chainguard recently released “The AI Exploit Gap,” a report exploring the space between operations and processes accelerated by the growing employment of AI and the much slower human pace of remediation. The report surveys 1,300 global cybersecurity leaders and was conducted by third-party research firm Wakefield Research.
According to the report, two-thirds (66%) of companies with revenue over $1 billion leave some high or critical vulnerabilities unpatched, compared to 27% of companies with revenue under $250 million. Crucially, these organizations are going unpatched knowingly and intentionally, not simply missing patches or letting them fall to the wayside by accident.
These statistics underline the key finding of the report: the assumption that a bigger budget correlates to better security cannot be relied upon. “There’s always this assumption that larger organizations have better security than smaller organizations. That’s often not what we see,” says John Strand, Owner, Black Hills Information Security. “Larger organizations have a larger attack surface, more people to target through social engineering, and a tremendous amount of legacy technology accumulated over decades.”
Larger Companies Choosing to Put Off Patching
Of the higher-revenue companies, the reasons for leaving vulnerabilities unpatched tend to stem from other needs taking precedence. Almost half (48%) of respondents working for these companies state that patching would be too disruptive to business operations. This is followed by 47% citing vulnerability prioritization criteria not being updated to meet AI-accelerated threats, and 46% citing revenue-generating work being prioritized over patching.
Smaller firms, those with less than $250 million in revenue, tend to have more fundamental issues with capacity constraints with patching vulnerabilities. Nearly three in five (59%) of survey respondents from these companies cite patch testing difficulty as a barrier to patching. Patching is treated by different-sized companies as either a business tradeoff or an operational risk, rather than a technical task.
Assumptions of Security
Many of these companies leave vulnerabilities unpatched as a holdover from the era before AI accelerated business operations and threats alike. Companies continue to treat acceptable risk the same way they did before the AI era, when exploit timelines were much slower. There was a time when most organizations would have had weeks of lead time between the disclosure of a flaw and the weaponization of that flaw in the wild. In that time, an unpatched backlog was a tolerable, managed debt.
AI Risk Makes Patching Urgent
In the age of AI tools and agents being rapidly adopted and deployed for business, personal, and criminal purposes, unpatched flaws can be found and chained within minutes. More than nine in ten (91%) of survey respondents state that AI-empowered acceleration of cyberattacks has changed their roles more than anything else in the past ten years.
More than half (54%) say that they expect AI discovery of vulnerabilities to routinely outpace remediation efforts within a year. More than three-fourths (77%) of security leaders who cite their own tools as “very effective” still expect a vulnerability to be exploited in the next year.
Existing Efforts Falling Short
The report also demonstrates the alarming ineffectiveness of current security efforts in the age of AI threats. Only 22% of respondents state that their organization’s security tools are “very effective” against AI-enhanced threats. Almost all organizations have taken one or more steps to mitigate AI-accelerated threats in particular, including staff reallocation (51%), new hires (40%), and increased scanning (42%).
The ongoing growth of AI-accelerated threats is not only operationally challenging, but also taxing on the organizational culture. Almost two-thirds (64%) of survey respondents report AI-empowered cyberattacks contributing significantly to their burnout in the last year. Almost all respondents (93%) state that they desire more urgency from senior leadership regarding AI-accelerated threats.
Shifting Mindsets to Impact Data
The report notes a negative correlation between urgency and exposure among survey respondents. Of the security leaders who think AI is already outpacing the capabilities of human remediation, 20% state that their organizations leave critical vulnerabilities unpatched at least sometimes. Of those who see AI outpacing human remediation capacity within the next year, that number increases to 50%, and of those who see AI outpacing human remediation as more than a year away, it goes up to 64%.
The perceived urgency of the AI threat is tied to lower levels of exposure and unpatched vulnerabilities. This is not an issue of budgets, but of the belief of leadership in the need to take steps to mitigate AI-enhanced threats.
Remediating Rising Risks
Closing the gap between AI-accelerated risks and organizations’ ability to remediate them demands a systemic, industry-wide effort to improve security capabilities. Unpatched vulnerabilities should be tied to documented, time-boxed risk exceptions, rather than left up to the judgment of each organization. Components should be designed to be secure by default and have fewer dependencies to account for the outsized risk presented by software supply chain networks. Automation can be employed to remove the friction of patching flaws from the revenue ledger, making the choice to patch less costly for small and large businesses alike.
The system of ranking threats based on theoretical severity should privilege exploitability more, to keep organizations informed of which vulnerabilities are the most pressing to patch. “The finding that 66% of billion-dollar companies knowingly leave high- or critical-severity vulnerabilities unpatched is concerning, but an unpatched vulnerability does not automatically mean an exploitable attack path,” according to Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security Technology Inc. “Severity tells us where to look; offensive validation helps establish what an attacker can accomplish.”
Questions that Boards Should Ask
When assessing an organization’s security strategy for how well it stands up to AI-accelerated attacks, company leadership must consider a number of factors. It is important to understand who signs off on each critical vulnerability going unpatched, and evaluate whether the company’s current risk tolerance reflects the reality of attacks accelerated by AI. Ultimately, in the age of AI, knowing about a flaw is no longer enough to control it without timely and robust patching protocols.
