Companies generating over $1 billion in annual revenue are more than twice as likely as firms earning under $250 million to knowingly leave high or critical security vulnerabilities unpatched, according to new research from Chainguard, a software supply chain security company. The study, released during Chainguard's Assemble London event on October 14, surveyed 1,300 cybersecurity leaders across 10 countries and found that artificial intelligence-driven attacks are reshaping how organizations approach vulnerability management while contributing to widespread burnout among security teams.

Sixty-six percent of security leaders at companies with $1 billion or more in revenue admitted they leave high or critical vulnerabilities unpatched at least sometimes, compared to just 27% of respondents at firms with under $250 million in revenue. The research identified different obstacles to patching across company sizes: larger organizations pointed to business trade-offs as their main barriers, with 48% citing excessive disruption to operations and 46% noting that revenue-generating work takes priority, while smaller companies faced capacity constraints, with 59% struggling to test patches properly. In response to these challenges, half of respondents said they'd reallocated staff to vulnerability remediation, 40% had hired additional security personnel, and 39% brought on more engineering staff. Organizations are also changing their approach to vulnerability risks by adopting secure-by-default software components (50%), cutting back on third-party dependencies (47%), and increasing how often they scan for vulnerabilities (42%).

AI-accelerated attacks are transforming the security landscape, with nine in ten respondents saying these threats have changed their job more than anything else in the past decade. More than half of those surveyed expect AI-powered vulnerability discovery to routinely outpace their teams within a year, and 93% expressed concern that their companies can't remediate AI-driven exploits quickly enough. The report found that 64% of security leaders say AI-accelerated attacks contributed moderately or greatly to their own burnout in the past year, and 96% said security-team burnout has some impact on their organization's ability to defend against AI threats, with 54% describing that impact as moderate or significant. Despite 70% of respondents saying it's easy to secure budget for AI-driven threat defense, only 22% rate their tools as very effective, 39% have bought tools they haven't rolled out yet, and even among those who view their tools as very effective, 77% still expect an exploit in the next year.

The disconnect between patching practices at large and small companies reflects fundamentally different organizational pressures, with larger firms prioritizing immediate business continuity over security fixes even when they have greater resources to deploy. AI's role in accelerating both vulnerability discovery and exploitation is forcing security teams to work faster than ever, creating a cycle where defenders struggle to keep pace despite increased spending and staffing. The survey spanned multiple industries across Brazil, France, Germany, Japan, Mexico, the United Arab Emirates, the United Kingdom, the United States, Saudi Arabia, and Singapore, with all respondents holding director-level positions or higher at companies with at least 500 employees (or 250 employees in Singapore, UAE, and Saudi Arabia). Nearly half of respondents—48%—say their investments in AI-driven threat defense still fall short of the protection boards and executive teams expect, underscoring a growing gap between security capabilities and leadership expectations. The stakes are only rising as defenders face an accelerating arms race where traditional patching timelines may no longer be viable against machine-speed threats. As organizations navigate this shift, the choice between operational convenience and security hardening will increasingly determine which companies remain resilient and which become cautionary tales.