A Chainguard study released at its Assemble London event on 14 October 2026 found that companies generating more than $1bn in revenue are more than twice as likely as smaller organisations to knowingly leave high or critical vulnerabilities unpatched. Specifically, 66% of security leaders in large-revenue firms admitted leaving such vulnerabilities unpatched “at least sometimes,” compared with 27% in companies with under $250m in revenue.
The research also highlighted differing patching barriers: larger organisations cited business trade-offs (46%) and disruption to operations (48%), while smaller firms pointed to capacity constraints and patch testing difficulties (59%).
To address these challenges, organisations reported reconfiguring staffing and processes: 51% had reallocated staff to vulnerability remediation, 40% had hired additional security personnel, and 39% had added engineering staff. Other shifts included adopting secure-by-default software components (50%), reducing third-party dependencies (47%), and increasing scanning frequency (42%).
The survey also underscored AI’s growing influence on security operations. About 91% of respondents said AI-accelerated attacks have changed their work more than anything in the past decade, and more than half expect AI-driven vulnerability discovery to outpace their teams within a year. Confidence in AI tools remains mixed: 39% have bought tools they have not rolled out, and only 22% rate their tools as “very effective,” even as 70% say securing budgets for AI-driven threat defence is easy.
The poll involved 1,300 cybersecurity leaders across ten markets, all from organisations with at least 500 employees (250 in Singapore, the UAE and Saudi Arabia).