The Exposure Debt Benchmark

Somewhere in a security team's vulnerability backlog right now, a confirmed vulnerability is waiting to be fixed. Whether uncovered by a security researcher or through agentic security testing, the finding has been validated and its potential impact assessed. Yet despite security teams resolving vulnerabilities faster than ever, this one remains open, with more findings arriving every week.

According to HackerOne's Security Research Report 2026, Exposure Debt: The Next Challenge in Cybersecurity, valid vulnerability reports awaiting resolution grew 131% between 2024 and 2026, even as the reports that did get fixed moved through the system more than twice as fast. So why, when the average resolution time fell from 135 days to 62 for all severities, is there such a gap between what gets found and what gets fixed?

The short answer is that discovery has outrun remediation, and what it leaves behind is exposure debt, the growing gap between the vulnerabilities an organization finds and the ones it can fix. Like any debt, it compounds, with each unresolved finding extending the window in which an attacker can act.

Key Findings from the 2026 Data

• Valid vulnerability reports awaiting resolution grew 131% from 2024 to 2026.
• Average resolution time fell from 135 days to 62 days over the same period.
• Nearly 70% of security leaders say findings arrive faster than their teams can remediate.
• Organizations with more than $10 billion in revenue averaged 84.2 valid reports in 2026, nearly six times the 14.5 averaged by organizations with $1 million to $5 million in revenue.
• 53% of security leaders report a higher volume of AI-assisted submissions, and 60% report better quality.

Get the full report

Why Is the Vulnerability Backlog Growing When Fixes Are Faster?

A backlog that grows 131% while resolution time falls by more than half sounds like a contradiction, but the explanation comes down to arithmetic.

Part of the drop likely reflects real progress, such as tighter workflows, clearer ownership, and faster routing to engineers. Part of it reflects what the average measures. The 62-day figure counts only reports that reached resolution, and because simpler fixes often close first, harder findings may be the ones left waiting. Meanwhile, new findings keep arriving faster than teams can validate and clear them, a pressure nearly 70% of security leaders now report. A team can improve every quarter and still watch its backlog grow.

Not every finding in that backlog carries the same weight. Security teams reasonably defer low-severity issues when compensating controls exist or when a fix costs more than the exposure it closes. Bug bounty findings provide valuable evidence of real vulnerabilities and, in many cases, demonstrate how they could be exploited. The scale of that discovery is significant: researchers on HackerOne earned $89 million in bounty payouts, an 18% increase year over year. But finding and validating vulnerabilities is only part of the challenge. When those findings remain unresolved, the debt is real.

“To close this gap, security teams need to know which exposures are genuinely exploitable, which pose the greatest risk, and where to focus limited resources. That is what a researcher does when they prove impact. They answer the questions that matter: Is this exploitable? How serious is it? What does it affect?” says HackerOne CEO Kara Sprague.

Watch our on-demand webinar, The Exposure Debt Crisis, to explore the growing gap between vulnerability discovery and remediation and what security teams can do about it.

Watch the On-Demand Webinar

Do Large Enterprises Carry More Exposure Debt?

Exposure debt also concentrates where operations are most complex. Enterprise programs averaged 84.2 valid reports in 2026, compared with 14.5 at the smallest organizations.

The reason is structural. Large companies run sprawling estates of applications, APIs, cloud assets, and third-party integrations, with ownership layered across all of them. A confirmed flaw may pass between several teams before it reaches someone with the authority to fix it, and each handoff adds time. Time is where the debt grows.

How Is AI Changing Vulnerability Discovery?

AI is adding to the inflow from another direction. Among security leaders, 53% report a higher volume of AI-assisted submissions, and 60% report better quality. That second figure may surprise anyone who has followed concerns about low-quality, AI-generated reports flooding programs. Instead, a majority of security leaders say the quality of AI-assisted submissions is improving.

Better reports still land in the same queue. Each submission has to be validated, confirmed vulnerabilities must be assigned to the teams that own the affected systems, and fixes or mitigations must be implemented. That work takes time and competes with other engineering priorities. So while more valid findings give organizations a clearer picture of their exposure, they can also add pressure to an already growing backlog.

What Does Exposure Debt Mean for Security Leaders?

All of this points to a shift in how organizations measure security effectiveness. Finding more vulnerabilities doesn't necessarily mean reducing more risk. The 2026 data shows why: discovery is moving faster than many organizations can keep up with remediation.

Resolution speed still matters, but it tells only part of the story. Tracking open, validated findings by severity and age provides a clearer picture of what's still exposed. For security leaders, the challenge is to connect discovery, validation, prioritization, and remediation into a continuous process that reduces risk rather than simply identifying more of it.

As Justin Lachesky, Director, Cyber Resilience, Redis explains:

“Our avg remediation is now 21% faster, but speed wasn't the only thing that mattered. The findings that took the longest to fix weren't the ones with the biggest security impact. And when we see a class of vulnerability that keeps coming up, we take a closer look at that part of the application rather than treating these as one-off things. Security leaders should look beyond how fast findings get closed and ask where risk keeps building.”

“Our avg remediation is now 21% faster, but speed wasn't the only thing that mattered. The findings that took the longest to fix weren't the ones with the biggest security impact. And when we see a class of vulnerability that keeps coming up, we take a closer look at that part of the application rather than treating these as one-off things. Security leaders should look beyond how fast findings get closed and ask where risk keeps building.”

Somewhere, that report is still in the queue, and the question for every security program is how long it stays there.

Next Steps: From Exposure Debt to Risk Reduction

The 2026 Security Research Report reveals a growing gap between vulnerability discovery and remediation. Explore the findings and what they mean for your security strategy.

Download the 2026 Security Research Report Get the full data and insights behind the exposure debt challenge.

Join Our Webinar Hear from security experts as they unpack the findings, discuss the implications for security teams, and explore how organizations can move from identifying exposures to reducing risk.

Frequently Asked Questions

What is exposure debt? Exposure debt is the growing gap between the vulnerabilities an organization finds and the ones it can fix, as defined in HackerOne's Security Research Report 2026.

What causes exposure debt? Exposure debt builds when vulnerability discovery outpaces remediation capacity. Expanding attack surfaces and program scope, combined with AI-assisted discovery, mean security researchers are surfacing more valid findings than ever. Remediation then depends on teams working across complex ownership structures, so the backlog grows when fixes can’t keep pace with what is being found.

How is exposure debt measured? Exposure debt is measured by tracking open valid findings by severity and age alongside resolution time. HackerOne's 2026 data shows the backlog grew 131% while average resolution time fell to 62 days.

About the report

HackerOne’s 2026 Security Research Report draws on three data sources analyzed or collected during summer 2026: aggregated and de-identified H1 Platform data from July 2025 through June 2026; a survey of 111 security leaders at organizations with more than $100 million in annual revenue across six countries; and a survey of 408 active HackerOne security researchers. Year-over-year survey findings compare independent respondent samples. The 2026 security leader survey included both HackerOne customers and non-customers and is not directly comparable with prior-year surveys. For this report, 2026 refers to the period from July 2025 through June 2026.