Vulnerability Backlog Crisis: Nearly Half of Large Firms Skip Verification Due to Time
A ProjectDiscovery survey reveals that nearly half of large organizations close or deprioritize vulnerability findings without full verification, risking unaddressed security flaws.
A significant portion of large organizations are struggling to keep up with their vulnerability management, with nearly half of security teams at companies with 5,000 or more employees admitting to closing or deprioritizing vulnerability findings without complete verification. The primary driver for this risky practice is a lack of time, according to a recent survey by ProjectDiscovery. This approach is particularly concerning given that a substantial majority of teams that do perform checks find that most of the vulnerabilities are indeed genuine, suggesting a high probability of real security weaknesses being left unaddressed.
The problem of growing vulnerability backlogs is widespread, with three out of four security teams reporting an increase over the past year. This influx is partly fueled by the increasing use of AI testing tools, which can generate a large volume of findings. For many large enterprises, the backlog has ballooned to over a thousand untriaged findings, with a quarter of them exceeding ten thousand. While some of these findings are indeed false positives or unexploitable, the inability to distinguish them from genuine threats without thorough investigation poses a significant risk.
Compounding the issue is the proliferation of vulnerability sources. Seven in ten teams pull findings from three or more sources, including scanners, bug bounty programs, penetration tests, and customer reports. Each source may describe the same vulnerability differently, leading teams to rely on a single tool as the source of truth and potentially missing findings from other sources. The more sources a team manages, the more likely they are to cut corners on verification, with teams using five or more sources being nearly twice as likely to close findings without full checks.
Interestingly, security leaders admit to this practice more readily than practitioners. More than half of leaders surveyed acknowledged closing or deprioritizing unverified findings due to time constraints, compared to about a third of practitioners. This suggests a potential disconnect in risk perception, with those in leadership positions more willing to accept the risk associated with an unverified backlog, even though nearly nine in ten teams that cut this corner worry about real vulnerabilities hiding within.
The role of AI in vulnerability management is a double-edged sword. While nearly half of respondents report that AI is increasing the volume of findings they need to manage, potentially exacerbating backlog issues, more than half also expect AI-powered attackers to exploit vulnerabilities before their teams can address them. On the flip side, just over a third of teams report that AI is helping them triage findings faster, and these teams are less likely to feel overwhelmed by their backlog.
This trend highlights a critical challenge in modern cybersecurity: the sheer volume of potential threats overwhelming the capacity for thorough investigation. The reliance on AI for both discovery and potential exploitation underscores the need for more efficient and effective vulnerability management strategies. Organizations must find ways to balance the speed of discovery with the necessity of accurate verification to avoid leaving themselves exposed to significant risks.
The survey's findings point to a systemic issue where resource constraints and the complexity of modern security environments force difficult trade-offs. The implication is that many organizations may be operating under a false sense of security, with a backlog of unverified issues potentially masking critical vulnerabilities that could be exploited by adversaries who are increasingly leveraging advanced tools, including AI, to find and exploit weaknesses.