Nearly half of large firms close unverified vulnerability findings
Original title: Nearly half of big firms shelve or close vulnerability findings they haven’t confirmed
Most large enterprises hold more than 1,000 untriaged findings, and about a quarter exceed 10,000.
ProjectDiscovery found that nearly half of security teams at organizations with 5,000 or more employees close or deprioritize vulnerability findings without fully verifying them, citing time. Among teams that skip checks, 57% say at least three in four findings they do verify are real. Mandiant’s cited average time for attackers to exploit a vulnerability fell from 63 days in 2018 to 7 days in 2025.
Unconfirmed: The article does not state the survey’s sample size or methodology.
- Three in four teams said their backlog grew over the past year.
- Nearly everyone says at least one in ten findings is fake or unexploitable.
- Seven in ten teams pull findings from three or more sources.
- Teams with five or more sources are nearly twice as likely to skip full checks.
- More than half of leaders admitted the practice, versus about a third of practitioners.
- Organizations
- ProjectDiscoveryMandiant
From the original article
2 min read at helpnetsecurity.com
Nearly half of security teams at organizations with 5,000 or more employees close or deprioritize vulnerability findings without fully verifying them, ProjectDiscovery found, and the reason they give is time. Here’s the catch. Among teams that skip full verification, 57% say at least three out of four findings they do check turn out to be real.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.