Big Companies Are Twice as Likely to Knowingly Leave Serious Security Flaws Unpatched

New research from software supply chain security firm Chainguard suggests that size does not guarantee better patching. In a study released during its Assemble London event on October 14, 66% of security leaders at companies with revenue of $1bn or more admitted leaving high or critical vulnerabilities unpatched "at least sometimes". Among companies earning under $250m, the figure was 27%.

The reasons differ by company size. Larger companies pointed to business trade-offs: patching being too disruptive to operations (48%) and revenue-generating work taking priority (46%). Smaller companies mostly cited capacity limits, with difficulty testing patches (59%) the main challenge. To respond, 51% of respondents said they had reallocated staff to vulnerability remediation, 40% had hired more security staff and 39% had added engineering staff. Others adopted secure-by-default software components (50%), reduced third-party dependencies (47%) or increased scanning frequency (42%).

AI is a major source of pressure. Some 91% said AI-accelerated attacks have changed their job more than anything else in the past decade, and more than half expect AI-powered vulnerability discovery to routinely outpace their teams within a year. In addition, 93% worry their company cannot fix AI-driven exploits quickly enough. Burnout is also a factor: 64% said AI-accelerated attacks contributed moderately or greatly to their own burnout, and 96% said team burnout affects their organisation's ability to defend against AI threats.