Most open critical and high flaws are over 90 days old
Detectify found 86-97% of open critical/high vulnerabilities on internet-facing systems of 1,293 customers exceed 90 days, with public sector remediating least.
Detectify analyzed payload-verified exposure data from 1,293 customers in the US, UK, and Nordics and found most open critical/high vulnerabilities are over 90 days old: 97% in the Nordics, 92% in the UK, and 86% in the US. Public-sector organizations resolved only 8.3% of critical/high findings within 90 days, the worst of five sectors, versus 46.2% for consumer brands. Organizations with publicly exposed AI tooling such as Open WebUI and LibreChat remediate flaws at less than half the average rate. The US holds the largest measured attack surface, growing about 20% in a year, while monitoring the smallest share of it.
- 97% Nordics, 92% UK, 86% US of open critical/high findings are over 90 days old.
- Public sector resolved only 8.3% of critical/high findings within 90 days, worst of five sectors.
- Exposed AI tooling correlates with remediation rates below half the wider customer base.
- US attack surface is largest, grew 20% in a year, yet is least monitored.
- Findings are payload-verified, so the backlog consists of scanner-confirmed exploitable issues.
- Organizations
- DetectifyRickard Carlsson
From the original article
4 min read at helpnetsecurity.com
Detectify analyzed exposure data from 1,293 of its customers in the US, the UK and the Nordics and found that most serious flaws still open on their internet-facing systems are months old. Of the critical and high-severity vulnerabilities open at the time of the snapshot, 97% in the Nordics had been exposed for more than 90 days, along with 92% in the UK and 86% in the US.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.