Chainguard published The AI Exploit Gap, a global report based on a survey of 1,300 security leaders examining the growing divide between AI-powered tools’ ability to identify and combine software vulnerabilities and organizations’ ability to remediate them. The findings show that 91% of security leaders say AI-driven attacks have changed their jobs more than any other development in the past decade, while 77% believe an attacker will likely exploit a software vulnerability at their organization within the next 12 months. However, 54% acknowledge that their organizations knowingly leave high- or critical-severity vulnerabilities unpatched at least occasionally, highlighting how remediation efforts are struggling to keep up with the accelerating threat landscape.
AI is expanding risk, and leaders are feeling it
The same technology making engineers faster is also making defenders’ jobs harder, and the pressure is landing on security leaders personally. Over half say burnout is affecting their team’s ability to defend against those same threats.
Security teams are facing a triple threat: frontier AI models finding vulnerabilities faster than ever, attackers using the same tools to exploit them, and supply chain attacks bringing in risk from outside the organization. Regulations, such as the EU Cyber Resilience Act and Product Liability Directive, are also adding to the pressure by raising the cost of leaving known vulnerabilities open. While engineering teams are on the frontlines of vulnerability remediation, security leaders, who are held responsible when a vulnerability is exploited, are often caught in the middle.
“AI has changed the security job faster than anything else in the past decade, and security leaders can see exactly where it’s heading. Most we talked to expect an attacker to exploit a vulnerability in their organization this year,” said Quincy Castro, Chief Information Security Officer, Chainguard. “But seeing the risk and being able to act on it are two different things. AI can find and chain flaws in minutes, while fixing them still moves at human speed and competes with product deadlines and uptime.
That’s the AI exploit gap, and it hits security and engineering teams in the areas where many historically struggled prior to AI. Thinking you’ll just patch faster is the Red Queen talking. Patching faster isn’t viable for most folks and it will consume increasing amounts of resources just to keep pace. The way out is for engineering and security to own the problem together and make prevention the standard, instead of just trying to run twice as fast.”
Where the gap is widening
The data shows that many organizations view exploitation as probable even when leaders have confidence in their security programs. Among respondents who rated their cybersecurity tools as very effective, 77% still expected an attacker to exploit a vulnerability in the next year. The same was true for 78% of leaders who considered their incident response teams very equipped to handle AI-driven attacks, and 77% of those who said investments had stayed ahead of the threat. Other key findings include:
- AI threats are fueling burnout: 64% of security leaders say concern about AI-accelerated attacks contributed moderately or greatly to their own burnout in the past year. Nearly all respondents (96%) say security-team burnout has some impact on their organization’s ability to defend against AI threats, and 54% describe that impact as moderate or significant.
- Machine-speed discovery is overtaking human-led remediation: 93% expressed concern that their companies cannot remediate AI-driven exploits quickly enough. More than half expect AI-powered vulnerability discovery to routinely outpace their teams within a year.
- Large and small companies face different barriers to patching: Companies with $1 billion or more in revenue leave high or critical vulnerabilities unpatched at more than twice the rate of companies with under $250 million in revenue (66% vs. 27% say they do so at least sometimes). Larger companies point to business trade-offs, such as revenue-generating work taking priority (46%) and patching being too disruptive to operations (48%), while smaller companies cite capacity constraints, such as difficulty testing patches (59%).
- Urgency is associated with lower exposure: Among leaders who believe AI already outpaces human remediation, 20% say their organizations leave critical vulnerabilities unpatched at least sometimes. That rises to 50% among those who expect AI to outpace remediation within a year and 64% among those who believe the shift is more than a year away.
- Teams are changing how they operate: 51% have reallocated staff to vulnerability remediation, 50% have adopted secure-by-default software components, 47% have reduced third-party dependencies, and 42% have increased scanning frequency. 40% have hired additional security staff, and 39% have added engineering staff.
- Organizations are continuing to spend: 70% say securing budget for AI-driven threat defense is easy, but 39% have bought tools they haven’t rolled out. Only 22% rate their tools “very effective,” and 77% of that group still expect an exploit in the next year. Nearly half (48%) say those investments still fall short of the protection boards and executive teams expect, and 93% believe senior leaders need to show greater urgency in addressing AI-accelerated threats.
The findings show security leaders aren’t short on awareness or budget. What’s missing is the ability to act at the speed AI now demands. Closing the AI exploit gap means treating prevention as the standard and making remediation a shared responsibility between engineering and security, so fewer vulnerabilities reach production in the first place.
Read the complete research findings in the AI Exploit Gap Report on the website here.
Related News:
Chainguard Reaches 94% Coverage Across Python, Java, and JavaScript
Chainguard Container Images Surpass 500 Million Container Build Manifests
