Billion-Dollar Companies Twice as Likely to Leave Critical Flaws Unpatched

Billion-dollar companies are more than twice as likely to knowingly leave high or critical security vulnerabilities unpatched compared to smaller firms, new research from software supply chain security firm Chainguard reveals.

The study, released on October 14, 2026, during its Assemble London event, found that 66% of security leaders in organisations with over $1 billion in annual revenue admit to sometimes neglecting critical vulnerability remediation. This contrasts sharply with 27% of respondents in companies generating under $250 million who reported the same issue.

Business Priorities Hinder Patching in Larger Enterprises

Chainguard’s research, based on a survey of 1,300 cybersecurity leaders, indicates that the barriers to effective patching differ significantly between large and small organisations. Larger companies frequently cite business trade-offs as primary hurdles, with 46% prioritising revenue-generating work over patching, and 48% finding patching too disruptive to operations.

Conversely, smaller companies often face capacity constraints. Approximately 59% of these firms highlight difficulties in testing patches as their main challenge. In response to these issues, organisations are reallocating staff to vulnerability remediation (51%), hiring additional security personnel (40%), and increasing engineering staff (39%). Other measures include adopting secure-by-default software components (50%), reducing third-party dependencies (47%), and increasing scanning frequency (42%).

AI-Accelerated Threats Add to Security Burden and Burnout

The study also underscored the transformative impact of artificial intelligence (AI) on the vulnerability and patching landscape. Nine out of ten (91%) respondents believe AI-accelerated attacks have changed their job more than any other factor in the past decade. More than half expect AI-powered vulnerability discovery to routinely outpace their teams within a year.

A significant 93% of security professionals expressed concern that their companies cannot remediate AI-driven exploits quickly enough, with the same proportion believing senior leadership needs to demonstrate greater urgency in addressing AI-accelerated threats. This increased pressure is contributing to burnout, with 64% of security leaders stating that AI-accelerated attacks moderately or greatly impacted their burnout levels in the past year. Nearly all respondents (96%) acknowledged that security-team burnout affects their organisation’s ability to defend against AI threats, with 54% describing the impact as moderate or significant.

Despite 70% of respondents finding it easy to secure budgets for AI-driven threat defence, investment effectiveness remains a challenge. Some 39% have purchased tools that have not been fully deployed, and only 22% rate their current tools as “very effective.” Even among those satisfied with their tools, 77% still anticipate an exploit within the next year, and nearly half (48%) feel current investments fall short of executive expectations. The survey was commissioned by Chainguard and conducted online in September 2026 by Wakefield Research across 10 global markets.