Billion-dollar firms report wider gaps in security patching

A global cybersecurity survey reveals that companies generating at least $1 billion annually are more than twice as likely to leave serious software vulnerabilities unpatched compared to smaller businesses. Research by software security company Chainguard found that 66% of security leaders at billion-dollar firms acknowledged leaving high or critical vulnerabilities unresolved at least sometimes, compared to 27% among companies earning less than $250 million.

The survey, conducted in September 2026, questioned 1,300 cybersecurity leaders across several countries and examined how artificial intelligence impacts the balance between discovering and correcting software weaknesses. Despite having larger budgets and security operations, major companies faced obstacles such as operational disruption and revenue-generating work taking precedence over patching.

Smaller companies, on the other hand, cited difficulties testing patches before deployment as a primary constraint. Nearly half of all respondents acknowledged leaving high or critical vulnerabilities unpatched occasionally, reflecting executives' assessments of their companies' practices rather than verified rates of successful cyberattacks.

AI-driven attacks are a significant concern, with 91% of respondents acknowledging AI-accelerated threats and 93% expressing anxiety about their ability to remediate these exploits quickly enough. Over half of the respondents expected AI-powered vulnerability discovery to outpace their security teams within a year. Despite having very effective cybersecurity tools, 77% of security leaders still anticipated an exploited vulnerability within their organisation within the next 12 months.

The study found that companies are beginning to adjust their security operations, with 51% reassigning employees to vulnerability remediation, 40% recruiting additional security personnel, and 39% expanding engineering teams. However, 48% of respondents rated their security tools as insufficient, and only 22% believed their tools were very effective.

The pressure of AI-accelerated threats also impacted employees, with 64% reporting increased burnout during the previous year due to these attacks.