Large Companies Twice as Likely to Leave Critical Vulnerabilities Unpatched, Research Finds
New research from Chainguard reveals that businesses with over $1 billion in revenue are significantly more prone to leaving critical vulnerabilities unpatched compared to smaller organizations.
A recent study by software supply chain security firm Chainguard indicates a concerning trend: large enterprises are more than twice as likely to knowingly leave high or critical vulnerabilities unpatched than their smaller counterparts. The research, presented during Chainguard's Assemble London event, found that 66% of security leaders in companies with revenues exceeding $1 billion admitted to sometimes leaving critical flaws unaddressed. In contrast, only 27% of respondents from companies earning under $250 million reported the same.
This disparity in patching practices appears to stem from differing challenges faced by organizations of various sizes. Larger companies frequently cited business priorities as the primary obstacle, with 46% indicating that revenue-generating work takes precedence over patching. Additionally, 48% of these larger organizations expressed concerns about the potential for patching to disrupt critical operations. Smaller companies, however, primarily pointed to capacity constraints, such as the difficulty in testing patches effectively, as their main hurdle.
In an effort to combat these persistent vulnerability risks, organizations are implementing various strategies. Over half of the respondents (51%) reported reallocating staff specifically to vulnerability remediation efforts. Furthermore, 40% have increased their security headcount, and 39% have expanded their engineering teams to better manage the workload. These internal adjustments highlight a growing recognition of the need for dedicated resources to address the ever-present threat landscape.
Beyond staffing changes, companies are also adopting more proactive security measures. Approximately 50% of respondents are moving towards adopting secure-by-default software components, aiming to build security into the development lifecycle from the outset. Another 47% are actively working to reduce their reliance on third-party dependencies, a common vector for supply chain attacks. To maintain better visibility, 42% of organizations have also increased the frequency of their security scanning operations.
The research also delved into the transformative impact of Artificial Intelligence (AI) on cybersecurity operations. A staggering 91% of security leaders surveyed believe that AI-accelerated attacks have had a greater impact on their jobs than any other factor in the past decade. Looking ahead, more than half anticipate that AI-powered vulnerability discovery will soon outpace their teams' capabilities within the next year.
Concerns about the pace of AI-driven threats are widespread, with 93% of respondents worried that their companies cannot remediate AI-accelerated exploits quickly enough. The same share believes senior leadership needs to demonstrate greater urgency in addressing these evolving threats. This sentiment is further compounded by the fact that 64% of security leaders attribute moderate to significant burnout to AI-accelerated attacks over the past year, impacting their organization's defensive posture.
Despite these challenges, investment in AI-driven threat defense continues, with 70% of respondents finding it easy to secure budgets for this purpose. However, the effectiveness of these investments is mixed, as 39% have purchased tools that remain largely unused, and only 22% rate their AI security tools as "very effective." Even among those satisfied with their tools, nearly half (48%) feel these investments still fall short of executive expectations.
The survey, commissioned by Chainguard and conducted by Wakefield Research, polled 1300 cybersecurity leaders across various industries and 10 global markets in September 2026. All participants held a minimum director-level seniority and worked for companies with at least 500 employees (or 250 in specific regions), providing a broad and representative view of the current cybersecurity landscape.