A Chainguard survey of 1,300 security leaders, released at its London event on 14 October, finds that two thirds of billion-dollar companies knowingly leave serious flaws open. Chainguard says budgets are not the main problem: staff are burning out, and almost four in ten organisations have bought tools they have not yet rolled out.
What happened
Software supply chain firm Chainguard published a report titled The AI Exploit Gap on 14 October 2026, timed for its Assemble London event. Wakefield Research carried out the survey in September for Chainguard. It covered 1,300 cyber security leaders at director level or above, at organisations with at least 500 staff (250 in Singapore and the Gulf), across nine markets that included the UK, US, France and Germany.
The headline finding is about company size. Among businesses with revenue of $1bn or more, 66% of security leaders admitted their organisation sometimes or more often knowingly leaves serious (high or critical) flaws open. At companies turning over less than $250m the figure was 27%. Across the whole sample it was 54%. More than three quarters (77%) think an attacker is likely to exploit a software flaw in their organisation within the next year.
The rest concerns people and money. Nearly two thirds (64%) of respondents said worry about AI-accelerated attacks had fed their own burnout to a moderate or large degree in the last year. Meanwhile 70% said budget for AI-driven threat defence is easy to get, yet 39% admitted buying tools they have not rolled out.
The detail
The reasons for leaving flaws open differ sharply by size. In larger firms they are commercial: 48% said patching disrupts operations too much and 46% said revenue-generating work takes priority. Smaller firms describe a capacity problem, and 59% named difficulty testing patches as their main obstacle. In other words, big organisations often decide not to patch, while small ones often cannot.
Organisations are responding mostly by moving people around. Just over half (51%) have shifted existing staff onto vulnerability remediation. Fewer have hired: 40% added security headcount and 39% added engineers. Structural changes are similarly common: 50% have adopted secure-by-default components, 47% have cut third-party dependencies and 42% now scan more often.
The spending figures stand out most. Only 22% rate their security tools as very effective, and even 77% of that group still expect to be breached through a vulnerability within a year. Almost half (48%) said their investment falls short of what the board expects, and 93% think senior leadership needs to treat AI-accelerated threats with more urgency. More than half expect AI-powered bug discovery to routinely outpace their teams within 12 months.
Chainguard’s CISO, Quincy Castro, argued that trying to patch ever faster is a losing race: “Thinking you’ll just patch faster is the Red Queen talking.” The report argues for making prevention the default and sharing remediation between engineering and security teams. That conclusion suits a company selling hardened open source components, but the workforce and spending figures stand on their own.
Why it matters for UK organisations
The report gives no UK breakdown, so the global figures should be read with care. They do, however, match the government’s own labour market data. The Cyber security skills in the UK labour market 2026 study, published by government in late September, estimates the UK cyber workforce at about 145,900 people, up only 2% on the previous year, compared with 5% growth the year before. It also found that 57% of UK businesses now have a basic technical cyber skills gap, up from 49%. In the public sector the gap nearly doubled, from 14% to 27%.
Put the two together and the conclusion is uncomfortable. Workloads are rising faster than the workforce, so remediation is being done by people pulled off other jobs. Burnout is the predictable result. The Chainguard figure that 96% of leaders believe team burnout affects their ability to defend is a business continuity risk as much as a welfare issue.
There is also a regulatory angle. The report notes that the EU Cyber Resilience Act and the revised Product Liability Directive increase the cost of shipping software with known vulnerabilities. UK manufacturers and software houses selling into the EU are in scope. At home, the Cyber Security and Resilience Bill, still before Parliament, would put more duties on managed service providers and other essential suppliers. Knowingly leaving critical flaws open because a revenue project came first will get harder to defend to regulators, insurers and customers.
Expert view
None of this surprises anyone who tests large estates for a living. In my experience, the critical findings that go unfixed in big organisations are rarely unknown. They are known, logged, risk-accepted and then forgotten, often because the system owner cannot get a maintenance window or the application team has moved on. The 66% figure reflects that organisational inertia more than any lack of tooling.
The finding about unused tools worries me more. When budget is easy to get and staff are scarce, buying a product feels like progress, but a platform that is never deployed adds licence cost and integration debt and protects nothing. I would rather see a client spend that money on one extra engineer who owns patching end to end than on another dashboard nobody has time to read.
Survey caveats apply. This is vendor-commissioned research, self-reported and global, and the respondents are leaders describing their own organisations. Treat it as a temperature check, not a benchmark. Still, its direction (more pressure, more spending, too little capacity to act) matches what we see on engagements.
What to do now
- Audit your risk acceptances. List every high or critical vulnerability marked as accepted or deferred, with an owner and an expiry date. Anything with no expiry is a decision nobody is accountable for. This sits squarely under the Cyber Essentials security update management control, which expects critical and high-risk updates within 14 days.
- Count your shelfware. Before approving new security spend, list tools that are licensed but not fully deployed. Either finish the rollout, with named resources, or cancel the licence and put the money into people.
- Measure workload, not just headcount. Track how many staff have been moved onto remediation and what work has stopped as a result. Report burnout indicators such as overtime, on-call load and attrition to the board alongside technical risk.
- Reduce the patch surface. Fewer third-party dependencies and secure-by-default base images mean fewer patches to apply. Use secure configuration principles to remove software you do not need.
- Fix the testing bottleneck. If patches stall because they cannot be tested, invest in staging environments and automated regression tests. This is often cheaper than another detection product.
- Agree patch windows in advance. For revenue-critical systems, agree recurring maintenance windows with the business now, so patching is not renegotiated every time a critical advisory lands.
Bottom line
Chainguard’s survey suggests the security industry does not lack money or awareness. It lacks people with the time to act. For UK organisations, where government data already shows a growing skills gap and a slowing workforce, the priority is to stop buying tools that never get deployed and invest in the people and processes that actually close vulnerabilities.
Sources
- PR Newswire: Chainguard Research: Nine in Ten Security Leaders Say AI Attacks Have Changed Their Job More Than Anything in a Decade
- Infosecurity Magazine: Billion-Dollar Companies Twice as Likely to Leave Critical Vulnerabilities Unpatched
- The New Stack: 66% of billion-dollar companies leave critical bugs unpatched
- GOV.UK: Cyber security skills in the UK labour market 2026
