Estimated reading time: 5 minutes
Fifty-four percent of security leaders admit leaving high- or critical-severity flaws unpatched at least sometimes, a Chainguard survey finds. At companies with $1 billion or more in revenue, it is 66%. Cyber insurers already write unpatched vulnerabilities into their policies.
Most security leaders expect attackers to get in through a software flaw this year. Many also admit to leaving known unpatched risks open.
A new Chainguard survey asked security leaders about both. Seventy-seven percent said an attacker is likely to exploit a vulnerability at their organization within a year. Fifty-four percent said their organization knowingly leaves high- or critical-severity vulnerabilities unpatched at least sometimes.
Wakefield Research surveyed 1,300 security leaders at director level and above in nine markets in September 2026. Most worked at companies with at least 500 employees. Chainguard, which commissioned The AI Exploit Gap, sells hardened open-source software components. Its conclusion, that companies should stop shipping vulnerabilities in the first place, is also its pitch.
Unpatched Vulnerabilities At The Largest Companies
The gap runs the opposite way from what size might suggest. At companies with $1 billion or more in revenue, 66% leave high or critical flaws open at least sometimes. Under $250 million, the figure is 27%.
The reasons differ. Smaller companies point to capacity, such as difficulty testing a patch before deployment (59%, against 45% at the largest firms). Larger companies point to business trade-offs. Forty-six percent say revenue-generating work wins out over patching, against 26% at smaller firms. Forty-eight percent say patching is too disruptive to operations.
Chainguard suggests large enterprises are more likely to run formal risk programs and choose to accept the risk. That also means they hold a written record of the flaws they chose to leave open.
Patching Speed And The AI Exploit Gap
Chainguard calls the problem the AI exploit gap. AI finds and chains flaws faster than human teams can fix them.
Only 19% of organizations said they could patch a newly discovered zero-day within a day. Fifty-one percent said it would take one to three days. Attackers move faster. Mandiant estimated the mean time to exploit a vulnerability at minus seven days in 2025, Cyber Insurance News reported. Exploitation routinely came before a patch existed.
Low-severity flaws carry more risk, too. Chainguard points to Anthropic’s April 2026 research on Claude Mythos Preview, which chained several minor bugs into a working exploit. Fifty-eight percent of respondents said they knowingly leave low- or medium-severity flaws open at least sometimes.
What Unpatched Vulnerabilities Mean For Cyber Insurance
Chainguard says a record of a known, open flaw “becomes hard to defend to a regulator, an insurer, or a jury.” Its report also says open vulnerabilities “can now lead to denied insurance claims.” It gives no example.
Insurers have written patching into coverage. Chubb’s Neglected Software Exploit Endorsement gives policyholders a 45-day grace period to patch a published vulnerability. After that, the policyholder takes on more of the risk at 46, 90, 180, and 365 days.
Applications ask about patching, and the answers can become the dispute. In 2015, Columbia Casualty went to court to avoid covering a data breach at Cottage Health System, Business Insurance reported. Among other things, the insurer cited the hospital’s statement that it regularly checked and maintained security patches.
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
Regulators are tightening the clock as well. The EU’s Cyber Resilience Act has applied reporting rules since 11 September. Manufacturers must give early warning within 24 hours of learning a flaw is being actively exploited. From 9 December, the EU’s revised Product Liability Directive treats software as a product.
Budget Is Not The Bottleneck
Seventy percent of security leaders said securing budget for AI-driven threat defense is easy. Thirty-nine percent have bought tools they have not rolled out. Ninety-three percent said their leadership needs to show more urgency.
That cuts against the usual story. Kaseya found 65% of managed service providers say their clients underinvest relative to their risk.
Finding the flaw was never the hardest part. Cyber Tzar CEO Andrew Horkan described one client on the Cyber Insurance News podcast. It paid £25,000 for a penetration test and had nothing left to fix what the test found.
FAQ – Unpatched Vulnerabilities And Risk
How many organizations leave vulnerabilities unpatched?
In a Chainguard survey of 1,300 security leaders, 54 percent said their organization knowingly leaves high- or critical-severity vulnerabilities unpatched at least sometimes.
Do large companies patch better than small ones?
Not by this measure. 66 percent at companies with 1 billion dollars or more in revenue leave serious flaws open at least sometimes, against 27 percent under 250 million.
What is the AI exploit gap?
Chainguard’s term for the gap between how fast AI finds and chains vulnerabilities and how fast human teams can fix them.
How fast can organizations patch a zero-day?
Only 19 percent said within a day. 51 percent said one to three days.
Do cyber insurance policies cover unpatched vulnerabilities?
It depends on the policy. Chubb’s Neglected Software Exploit Endorsement gives a 45-day grace period, then shifts more of the risk to the policyholder over time.
Who conducted the survey?
Wakefield Research, commissioned by Chainguard, in September 2026. Respondents were director-level and above security leaders in nine markets.
Related Cyber Insurance Posts
- The MFA Box Is Ticked. Attackers Walk Through It Anyway.
- 97% Used to Be a Good Grade—But Not for Retailers Facing Data Breaches(Opens in a new browser tab)
- Cyberattacks on Schools: Why Educational Institutions Are Prime Targets – KnowBe4 Report(Opens in a new browser tab)
- Cybersecurity For Insurers: Triple-I And Fenix24 Spotlight Recovery Gaps, MFA Risks, And Patch Pressure(Opens in a new browser tab)
- Shocking NFL Draft Prank Exposes Cybersecurity Flaws in Remote Work(Opens in a new browser tab)