Survey of 1,300 security leaders finds 77% expect an attacker to exploit a vulnerability at their organization in the next year, while 54% say their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes

KIRKLAND, Wash., Oct. 14, 2026 /PRNewswire/ -- Chainguard, the trusted source for open source, today released The AI Exploit Gap, a global report surveying 1,300 security leaders, that explores the widening distance between how fast AI-powered tools can find and chain vulnerabilities and how fast human teams can fix them. Nine in ten (91%) security leaders say AI-accelerated attacks have changed their job more than anything else in the past decade, and 77% believe it is likely an attacker will exploit a software vulnerability at their organization within the next 12 months. Yet 54% acknowledge their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes, a sign that the ability to act hasn't kept pace with the speed of change.

AI is expanding risk, and leaders are feeling it

The same technology making engineers faster is also making defenders' jobs harder, and the pressure is landing on security leaders personally. Over half say burnout is affecting their team's ability to defend against those same threats. Security teams are facing a triple threat: frontier AI models finding vulnerabilities faster than ever, attackers using the same tools to exploit them, and supply chain attacks bringing in risk from outside the organization. Regulations, such as the EU Cyber Resilience Act and Product Liability Directive, are also adding to the pressure by raising the cost of leaving known vulnerabilities open. While engineering teams are on the frontlines of vulnerability remediation, security leaders, who are held responsible when a vulnerability is exploited, are often caught in the middle.

"AI has changed the security job faster than anything else in the past decade, and security leaders can see exactly where it's heading. Most we talked to expect an attacker to exploit a vulnerability in their organization this year," said Quincy Castro, Chief Information Security Officer, Chainguard. "But seeing the risk and being able to act on it are two different things. AI can find and chain flaws in minutes, while fixing them still moves at human speed and competes with product deadlines and uptime. That's the AI exploit gap, and it hits security and engineering teams in the areas where many historically struggled prior to AI. Thinking you'll just patch faster is the Red Queen talking. Patching faster isn't viable for most folks and it will consume increasing amounts of resources just to keep pace. The way out is for engineering and security to own the problem together and make prevention the standard, instead of just trying to run twice as fast."

Where the gap is widening

The data shows that many organizations view exploitation as probable even when leaders have confidence in their security programs. Among respondents who rated their cybersecurity tools as very effective, 77% still expected an attacker to exploit a vulnerability in the next year. The same was true for 78% of leaders who considered their incident response teams very equipped to handle AI-driven attacks, and 77% of those who said investments had stayed ahead of the threat. Other key findings include:

• AI threats are fueling burnout: 64% of security leaders say concern about AI-accelerated attacks contributed moderately or greatly to their own burnout in the past year. Nearly all respondents (96%) say security-team burnout has some impact on their organization's ability to defend against AI threats, and 54% describe that impact as moderate or significant.
• Machine-speed discovery is overtaking human-led remediation: 93% expressed concern that their companies cannot remediate AI-driven exploits quickly enough. More than half expect AI-powered vulnerability discovery to routinely outpace their teams within a year.
• Large and small companies face different barriers to patching: Companies with $1 billion or more in revenue leave high or critical vulnerabilities unpatched at more than twice the rate of companies with under $250 million in revenue (66% vs. 27% say they do so at least sometimes). Larger companies point to business trade-offs, such as revenue-generating work taking priority (46%) and patching being too disruptive to operations (48%), while smaller companies cite capacity constraints, such as difficulty testing patches (59%).
• Urgency is associated with lower exposure: Among leaders who believe AI already outpaces human remediation, 20% say their organizations leave critical vulnerabilities unpatched at least sometimes. That rises to 50% among those who expect AI to outpace remediation within a year and 64% among those who believe the shift is more than a year away.
• Teams are changing how they operate: 51% have reallocated staff to vulnerability remediation, 50% have adopted secure-by-default software components, 47% have reduced third-party dependencies, and 42% have increased scanning frequency. 40% have hired additional security staff, and 39% have added engineering staff.
• Organizations are continuing to spend: 70% say securing budget for AI-driven threat defense is easy, but 39% have bought tools they haven't rolled out. Only 22% rate their tools "very effective," and 77% of that group still expect an exploit in the next year. Nearly half (48%) say those investments still fall short of the protection boards and executive teams expect, and 93% believe senior leaders need to show greater urgency in addressing AI-accelerated threats.

The findings show security leaders aren't short on awareness or budget. What's missing is the ability to act at the speed AI now demands. Closing the AI exploit gap means treating prevention as the standard and making remediation a shared responsibility between engineering and security, so fewer vulnerabilities reach production in the first place.

Read the complete research findings here.

Methodology
This survey was commissioned by Chainguard and conducted by Wakefield Research, a third-party research partner, to collect responses from 1,300 cybersecurity leaders globally. Respondents were chosen from a variety of industries, and organization sizes and revenues. All respondents had a minimum seniority of Director, and worked for companies with at least 500 employees (except in Singapore and UAE/Saudi Arabia, where the minimum was 250 employees). Respondents were chosen from nine markets: U.S., U.K., France, Germany, Brazil, Singapore, Mexico, UAE/Kingdom of Saudi Arabia (KSA), and Japan, in September 2026, using an email invitation and an online survey.

About Chainguard
Chainguard is the trusted source for open source. By providing engineers and AI agents with hardened, trusted, and production-ready artifacts, Chainguard helps organizations prevent AI supply chain attacks, increase engineering velocity while reducing toil, and maintain continuous compliance. Customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, DocuSign, OpenAI, Public Storage, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. For more information, visit: https://www.chainguard.dev/ 

Contact:
Brittany Hendrickson
press@chainguard.dev

View original content to download multimedia:https://www.prnewswire.com/news-releases/chainguard-research-nine-in-ten-security-leaders-say-ai-attacks-have-changed-their-job-more-than-anything-in-a-decade-but-the-ability-to-act-hasnt-kept-pace-302907743.html

SOURCE Chainguard