4 min read<\/p>\n
Whereas vulnerabilities used to take weeks to be weaponised after disclosure, the gap is now often measured in days. Attackers are using AI to shrink that window even further as the total number of published CVEs climbs. The State of Vulnerabilities Report 2026 analyses more than 11,000 findings from live customer environments. Its headline: risk is no longer driven by the sheer volume of gaps, but by the speed at which the critical ones are closed.<\/strong><\/p>\n Key Takeaways<\/p>\n Related:<\/span>Adaptive MFA as a Zero-Trust lever<\/a> \/<\/span> When the reporting-clock starts ticking<\/a><\/p>\n The threat landscape tightened in 2025. Attackers are using AI to compress the interval between vulnerability disclosure and active exploitation. Last year alone, industry-wide CVE disclosures rose 20 % to more than 48,000. The State of Vulnerabilities Report 2026 drilled into more than 11,000 vulnerabilities from live customer environments in 2025.<\/p>\n The report comes from Synack, a provider of AI-powered penetration testing. Its focus is less on the raw volume of findings and more on their accelerating dynamics.<\/p>\n \u201cRules changed in 2025. Time is now the biggest vulnerability. Attackers will always find new gaps; what has changed is the speed at which they discover and weaponise them.\u201d The total number of vulnerabilities identified remained largely stable year-over-year. What changed was their composition. High-severity findings increased by 10 percent. The most pronounced rise came from remote code execution, which surged by 39 percent. Brute-force attacks climbed 17.4 percent, while content injection grew by 8 percent.<\/p>\n The report interprets this pattern as a shift toward identity-based attacks. It aligns with the observation that attackers are leveraging AI to probe access controls at scale. For security teams, the sheer volume of findings matters less. What counts is which gaps create real attack paths-and which should be closed first.<\/p>\n 47 percent<\/p>\n Reduction in remediation time with continuous testing<\/p>\n Organizations running continuous tests resolved high-severity gaps 42 days<\/strong> faster than in 2024, and critical gaps 38 days<\/strong> faster. At the same time, 37 percent<\/strong> of all findings were either critical or high-severity.<\/p>\n<\/div>\n What is MTTR?<\/strong> Mean Time To Remediate measures the average time from vulnerability discovery to resolution. The shorter this window, the smaller the window of opportunity for exploitation. The report highlights this metric as a key lever against accelerating attack speeds.<\/p>\n<\/div>\n The share of critical and high-severity vulnerabilities in 2025 reached 37 percent. Manufacturing led with 43.1 percent, followed by the technology sector at 40.0 percent.<\/p>\n Among findings mapped to the OWASP Top 10:2025, two classes dominated. Injection flaws accounted for 40.6 percent, while broken access controls made up 32.8 percent. Together, they represented the bulk of OWASP-mapped findings.<\/p>\n AI and LLM systems also drew more scrutiny from assessors. Security assessments in this area on the evaluated platform jumped 120 percent. The report reads this as a signal that AI infrastructures are increasingly treated as standalone attack surfaces-not merely as tools used by attackers.<\/p>\n Clear priorities for vulnerability management emerge from the data.<\/p>\n The key takeaway remains: the number of vulnerabilities found doesn\u2019t determine risk-it\u2019s how quickly the critical ones are neutralized.<\/p>\n The report analyzes more than 11,000 vulnerabilities discovered in 2025 across live customer environments. It is published by Synack, a provider of AI-driven penetration testing. The findings are categorized by severity, type, and industry.<\/p>\n Both trends are happening simultaneously. In 2025, over 48,000 CVEs were published industry-wide-20 percent more than the previous year. At the same time, continuous testing is cutting remediation times. More known gaps don\u2019t automatically translate into greater risk as long as critical flaws are closed quickly.<\/p>\n MTTR stands for Mean Time To Remediate, the average time to resolution. Across all categories, the report shows a 47 percent drop. The shorter this window, the smaller the opportunity for attackers to exploit a known gap.<\/p>\n The manufacturing sector recorded the highest share of critical and high-severity findings at 43.1 percent, followed by the technology sector at 40.0 percent. Across all industries, the average share was 37 percent.<\/p>\n Security assessments of AI and LLM systems surged by 120 percent. This signals that these systems are not only used as attack tools but are themselves becoming attack surfaces that require dedicated testing.<\/p>\n\n
The window between disclosure and attack keeps shrinking<\/h2>\n
\n
\n– Dr. Mark Kuhr, Co-founder & CTO, Synack<\/cite>\n<\/p><\/blockquote>\nThe risk structure is shifting<\/h2>\n
Where the critical findings are concentrated<\/h2>\n
AI environments become targets in their own right<\/h2>\n
What security teams should prioritize now<\/h2>\n
Frequently Asked Questions<\/h2>\n
What is the State of Vulnerabilities Report 2026?<\/h3>\n
Why are CVE counts rising even as fixes get faster?<\/h3>\n
What does MTTR stand for and why is the decline important?<\/h3>\n
Which industries are most affected?<\/h3>\n
Why do AI environments appear in the report?<\/h3>\n
Editor\u2019s Reading Picks<\/h3>\n