Estimated reading time: 2 minutes
Key takeaways:
- Fixing vulnerabilities, not finding them, is the bottleneck.
- Patches stall on engineering constraints like testing and disruption.
- Prevention beats patching faster.
A survey of 1,300 security leaders finds that finding vulnerabilities is no longer the hard part. Fixing them is, and that work lands on engineering teams.
More than three-quarters (77%) of security leaders expect an attacker to exploit a software vulnerability at their organization in the next 12 months. Meanwhile, 54% say their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes.
Those figures come from The AI Exploit Gap, a report commissioned by Chainguard and conducted by Wakefield Research.
It surveyed security leaders at director level or above, at companies with 500 or more employees. The report defines the AI exploit gap as the distance between how fast AI tools can find and chain vulnerabilities and how fast human teams can fix them.
Your inbox, upgraded.
Receive weekly engineering insights to level up your leadership approach.
Better tools don’t lower expectation
Budget is not the obstacle: 70% of those polled say securing money for AI-driven threat defense is easy. Yet 39% have bought tools they haven’t rolled out, and only 22% rate their tools “very effective.” Among that 22%, 77% still expect an exploit this year.
Some 93% of respondents worry their companies can’t fix AI-driven exploits fast enough. That fix is engineering work like changing code, testing it, and shipping it.
The AI exploit gap lives in the patch queue
Larger companies leave known problems open more often. At companies with $1 billion or more in revenue, 66% say they leave high or critical vulnerabilities unpatched at least sometimes, against 27% at companies under $250 million.
Large companies cite disruption to operations (48%) and revenue-generating work taking priority (46%). Smaller companies cite difficulty testing patches (59%).
Both are engineering problems because a patch that can’t be tested safely, or shipped without disruption, waits behind the roadmap.
Prevention moves into build decisions
Teams are already changing how they work, with 50% having adopted secure-by-default components and 47% cutting their third-party dependencies.
Chainguard’s CISO Quincy Castro says patching faster won’t close the gap. “Thinking you’ll just patch faster is the Red Queen talking,” he says. “Patching faster isn’t viable for most folks and it will consume increasing amounts of resources just to keep pace.”
More like this
The way out is for engineering and security to own the problem together and make prevention the standard, instead of just trying to run twice as fast, Castro adds.
Berlin • November 9 & 10, 2026
Close the gap between what leadership expects and what’s actually possible at LeadDev Berlin.
Urgency tracks with exposure
Among leaders who believe AI already outpaces human remediation, 20% say they leave critical vulnerabilities unpatched at least sometimes. That rises to 50% among those who expect it to within a year and 64% among those who think the shift is more than a year away.
Almost every respondent wants senior leaders to show more urgency. The survey shows a link, not a cause. Still, teams that treat the problem as urgent now fix more of it.
Tools won’t close this gap on their own. It closes in your delivery pipeline: how fast a critical patch gets tested and shipped, who can move it ahead of the roadmap, and how many dependencies you carry that you’ll have to patch later.
Security leaders can see the problem, but engineering controls the fix. Ask your team how long a critical patch takes to reach production and who decides when it jumps the roadmap. If nobody can answer, you’ve found your gap.
