HackerOne’s newest report reveals a stark shift: remediation speed has improved, yet AI‑accelerated vulnerability discovery is adding new findings to backlogs faster than teams can fix them, driving the total number of unresolved, validated issues to a historic high.
Rising Discovery Rate vs. Faster Fixes
Over the past year, the average time to close a vulnerability dropped from 135 days to 62 days, a 54% acceleration in remediation speed. At the same time, the total pool of known, validated issues that remain open grew by 131% over the last two years. A separate survey of 111 security leaders found that 70% now see new validated findings entering their backlog more quickly than they can remediate them. These numbers indicate that faster fixes are being outpaced by an even faster influx of discoveries.
Implications for Vulnerability Operations (VulnOps)
HackerOne CEO Kara Sprague notes that researchers are leveraging AI to uncover vulnerabilities, putting pressure on DevSecOps teams. The report suggests that teams should consider integrating AI into their remediation workflows and formalizing VulnOps practices to keep pace. While the exact adoption rate of AI‑assisted remediation is unclear, the growing use of AI by attackers—who can reverse‑engineer an exploit in hours—means the window between disclosure and exploitation is shrinking dramatically.
AI‑Generated Code Risks and New Finding Types
As developers adopt AI for code generation, two specific issue categories have surged: system prompt leakage reports (+557%) and output‑handling problems (+264%). These represent novel exposure vectors that traditional static analysis tools may not catch. Security leaders are responding: 75% now formally track “exposure debt,” a metric that quantifies the cumulative risk of unresolved findings.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Practitioners should evaluate their current vulnerability management stack against the following considerations:
- Prioritize AI‑enhanced triage. Deploy models that can rank findings by exploitability or business impact to focus limited remediation bandwidth.
- Automate repeatable fixes. Identify patterns in AI‑discovered bugs that lend themselves to scripted remediation or configuration enforcement.
- Expand monitoring for AI‑specific artefacts. Add detection for prompt leakage and unsafe output handling into CI/CD security gates.
- Track exposure debt as a KPI. Use the emerging “exposure debt” metric to surface backlog growth trends and justify resource allocation.
- Invest in upskilling. The survey of 408 security researchers shows 85% are actively learning AI techniques, and 68% have shifted to higher‑complexity bugs with AI assistance. Matching that skill set internally can reduce reliance on external bounty programs.
In short, the data confirms that faster remediation alone will not close the gap. Teams must adopt AI‑driven processes, broaden their detection scope, and treat backlog growth as a strategic risk indicator.
