Nearly half of big firms shelve or close vulnerability findings they haven’t confirmed
Nearly half of large firms close vulnerability findings without full verification due to time constraints.
A ProjectDiscovery report reveals that nearly half of security teams in large organizations (5,000+ employees) close or deprioritize vulnerability findings without full verification, citing time constraints. Despite this, 57% of these teams find that most of the findings they do check are legitimate. The backlog of vulnerabilities is growing, with many large enterprises having over a thousand untriaged findings, and AI testing tools are contributing to this increase.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ProjectDiscovery?
Get an email when a new story names ProjectDiscovery, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNearly half of security teams at large organizations are closing or deprioritizing vulnerability findings before fully verifying them, primarily due to time pressure and backlog volume. This is dangerous because 57% of findings that teams do investigate turn out to be legitimate threats — meaning shelved findings likely contain real, exploitable vulnerabilities. The growing use of AI-powered testing tools is accelerating the volume of findings faster than teams can process them, widening the gap between discovery and remediation. Ignoring unverified vulnerabilities is essentially accepting unknown risk, leaving organizations exposed to breaches that could have been prevented with proper triage processes.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Breach and attack simulation
You only find out whether your security tools stop an attack when a real attacker tries.
- SOC automation and AI analysts
Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.