devopsy.kinsta.cloud

Tag: vulnerability remediation

HackerOne Report Surfaces Massive Increase in Vulnerability Backlogs

An analysis of the backlog of vulnerabilities published today by HackerOne finds that while the rate at which issues are being resolved has increased 54% in the past year there has also been a 131% over the last two years in the total number of known validated issues that have not been resolved.

On average, organizations have cut average resolution time from 135 days to 62 days, but the pace at which vulnerabilities are being discovered in the artificial intelligence (AI) era continues to increase. In fact, a separate survey of 111 security leaders finds 70% are seeing validated findings being added to their backlogs faster than they are being remediated.

HackerOne CEO Kara Sprague said that as researchers make use of AI to discover vulnerabilities, it’s apparent that DevSecOps teams are starting to be overwhelmed. As a result, it’s clear that many of those teams now need to start applying AI to remediate vulnerabilities faster by, for example, formally addressing best vulnerability operations (VulnOps) practices, she added.

It’s not clear at what rate DevSecOps teams are embracing AI to reduce exposure debt, but as cybercriminals become more adept at using AI to discover and exploit vulnerabilities, it is now a race against time. In many instances, it is now possible for cybercriminals to create an exploit by reverse engineering a vulnerability in a matter of hours. Historically, DevSecOps teams have counted on the fact that they typically had a few months between when a vulnerability was first disclosed and an exploit might actually manifest.

More challenging still, as application developers embrace AI to write code, DevSecOps teams are also contending with emerging issues such as a 557% increase in system prompt leakage reports and a 264% increase in output handling, according to the HackerOne analysis.

On the plus side, three-quarters (75%) of security leaders report their organization now formally tracks exposure debt. The challenge is that security researchers are using AI to discover even more issues. Another survey of 408 security researchers conducted by HackerOne finds 85% are actively upskilling using AI, with nearly three-quarters reporting they have seen a meaningful increase in valid findings. More than two-thirds (68%) have shifted toward higher-complexity, higher-bounty bugs with the help of AI.

In fact, HackerOne reports that researchers using its platform to find and report vulnerabilities earned a record $89 million from July 2025 to June 2026. Organizations running bug bounty programs on the H1 Platform awarded $89 million to security researchers, an 18% increase over the prior year and the highest annual total in the platform’s history.

No one knows for certain how long the accelerated rate at which vulnerabilities are being discovered will continue, but even with the help of AI, it’s apparent more resources need to be devoted to remediation. The challenge is that far too many organizations are still devoting a much higher percentage of their application development effort toward building new applications and adding features to existing ones versus reducing their application security debt, noted Sprague. In fact, in the 10 years that HackerOne has been sharing its application security reports, the overall level of exposure debt has never been higher, she added.

Unfortunately, it usually requires some actual crisis before an organization revisits its DevSecOps strategy. While the number of vulnerabilities being discovered has clearly increased, it’s not quite clear there has been a corresponding increase in the number of breaches. As always, however, an ounce of DevSecOps prevention is worth a pound of any cybersecurity incident management that will have to be applied long after the damage has already been done.

October 7, 2026
GitHub’s Security Autofix Agent Now Remembers What It Fixed

Most codebases have a favorite mistake. It might be a query built from string concatenation, or a missing check on user input. A developer fixes it in one file. A few weeks later, the scanner finds the same flaw in another file, and the fix starts from scratch.

GitHub wants to stop paying for that lesson twice. On September 25, the company said agentic autofix now uses Copilot Memory for customers who have turned Memory on. Before the agent works on a security alert, it checks stored memories for context that might help. After it creates a fix, it saves the fix pattern as a memory for later use.

Those patterns don’t stay inside autofix. According to GitHub’s changelog, they help the agent resolve other security alerts, and they inform other Copilot features, including code review and the Copilot cloud agent, about secure development practices specific to the repository.

Both agentic autofix and Copilot Memory are still in public preview.

How the Pieces Fit

Agentic autofix entered public preview on July 10. Instead of a one-shot suggestion, a developer assigns a code scanning alert to Copilot. The agent explores relevant files, proposes a fix, and reruns CodeQL to confirm the alert is gone. If it isn’t, the agent tries again. Then it opens a draft pull request that explains the fix. GitHub says this usually takes two to four minutes.

The feature requires a GitHub Code Security or Advanced Security license, plus a Copilot license with the cloud agent enabled. It also uses the organization’s AI credits and GitHub Actions minutes.

Copilot Memory is the other half. It stores two kinds of information: facts about a repository, such as coding conventions, architecture decisions, and build commands, and a user’s personal preferences. Repository facts stay in the repository where they were learned.

The design detail that matters most here is validation. GitHub’s documentation says repository facts are stored “with citations pointing to the code that supports them.” Before Copilot uses a fact, it checks those citations against the current branch. Only validated facts get used. And any fact that goes unused for 28 days is deleted automatically.

For individual plans, Memory is on by default. For plans managed by an organization or enterprise, an administrator has to enable the policy first. So in most enterprise shops, this update does nothing until someone makes that call.

From Fixing to Preventing

The interesting part isn’t that autofix gets a little smarter. It’s that a fix now teaches the rest of the toolchain.

In most organizations, security knowledge dies in the pull request. A developer fixes an alert, and the next developer who makes the same mistake never sees the fix.

With memory in the loop, a fix pattern can reach code review. If Copilot code review knows how this repository handles a certain class of vulnerability, it has a better chance of flagging the same mistake in a new pull request before it merges. That moves the work earlier, from cleaning up alerts to catching them in review.

Mitch Ashley, vice president and practice lead for CIO & technology buyers and software lifecycle engineering at The Futurum Group, sees a bigger point in how GitHub built it. “GitHub’s move matters because of what it says about agent trust. A system earns trust by showing its work, not by producing more of it,” he says. “Tying a fix pattern to citations that expire once the code changes is a real step toward self-evidencing agent memory, a piece most agentic tooling still lacks.”

Questions to Ask First

This is a preview, and teams should treat it that way. A few things are worth checking before you rely on it.

First, what gets remembered, and when? The changelog says autofix saves the fix pattern when it creates a fix. It doesn’t say whether that happens before or after a human approves the pull request. Ashley thinks that detail carries a lot of weight. “Whether autofix banks a pattern before or after a human approves the fix will decide how much this helps. Bank it too early, and a weak pattern can spread faster than review catches it.”

Second, who turns it on? In an enterprise, the Memory policy is an admin decision. Security and platform teams should make it together.

Third, what does it cost? Every agentic autofix run uses AI credits and Actions minutes. If memory helps the agent clear more alerts, usage may rise.

Fourth, how long do lessons last? The 28-day expiry keeps stale facts from piling up. It also means a pattern tied to a rare class of bug may fade before that bug shows up again.

The Bigger Picture

AI coding agents have mostly worked like contractors who show up with no notes from the last job. Memory changes that. It gives an agent a record of how a specific team writes and secures its code.

That’s useful. It’s also a new thing to govern. Teams will need to know what’s in an agent’s memory and where it came from.

For DevOps teams, the practical step is simple. If you’re already testing agentic autofix, turn on Memory in a few repositories with a steady flow of security alerts. Then watch whether the same findings stop coming back. And watch your own team, too. “Watch whether teams that enable Memory also tighten scrutiny of agent-written fixes instead of just clearing more alerts,” Ashley says.

September 28, 2026
IBM and Red Hat Launch Lightwell Catalog to Automate Remediation

IBM and Red Hat this week revealed that Lightwell Network, a catalog of more than 6,500 application-layer dependencies that drives an automated vulnerability remediation service, is now generally available.

At the same time, the Lightwell Clearinghouse Premier service, through which application development teams can both access validated patches and coordinate remediation efforts, is now available to a limited number of organizations.

Ben Breard, a senior principal product manager at Red Hat, said collectively these two offerings will make it simpler for organizations to address 30 years of technical debt that is now being exposed by artificial intelligence (AI) models that make it possible to discover vulnerabilities and create exploits in a matter of hours.

At the core of the Lightwell service is a remediation engine that software engineers are using to
help identify, validate, and remediate vulnerabilities across critical dependencies embedded deep within modern software architectures. Lightwell then employs automation to backport critical fixes directly to specific, long-lived production software versions to reduce the amount of time required to update applications.

Organizations that subscribe to the Lightwell Network receive a continuous stream of digitally signed binaries, source code, and compliance artifacts, including software bills of materials (SBOMs).

Technology partners working with IBM and Red Hat to provide software artifacts and updates include Amazon Web Services (AWS), AMD, F5, GitLab, Intel, JFrog, Microsoft, NVIDIA, Palo Alto Networks, and ServiceNow. Providers of IT services that are also participating include Accenture, Atos, Cognizant, Deloitte, EY, HCLTech, Infosys, Kyndryl, LTM, NTT DATA, Tata Consultancy Services (TCS), and Tech Mahindra.

IBM and Red Hat earlier this year pledged $5 billion toward the Lightwell initiative through which more than 20,000 engineers are working to remediate vulnerabilities that might have been created by humans many years ago or an AI coding tool a few days ago. For example, IBM and Red Hat have remediated a vulnerability dating back to 2001 involving a legacy Apache Debian package that is still found in enterprise environments more than two decades later.

Ultimately, the goal is to rapidly improve the quality of the code that will increasingly be targeted by cybercriminals as they gain access to more advanced AI models, noted Breard.

Right now, access to advanced AI models from Anthropic and OpenAI is limited in the hopes that organizations will be able to remediate code before the volume of expected attacks starts to rise. However, cybercriminals are already using a range of AI models to discover vulnerabilities and craft exploits. As those AI models become more advanced in the weeks and months ahead, the more lethal the attacks against software supply chains will become.

The fundamental challenge is two-fold. Organizations that have deployed software need to discover and remediate as many existing vulnerabilities in their code bases as quickly as possible. Historically, organizations tended to wait months before applying a patch to ensure that any update made would not inadvertently take their applications offline. That process, however, now needs to occur in days and weeks to prevent cybercriminals from exploiting those weaknesses.

The second element is providing the maintainers of the open source software that is frequently being targeted with the tools and expertise they need to resolve application security issues. At the moment, organizations are discovering issues using AI, but few are contributing validated code to help open source maintainers resolve an issue. Far too many of the contributions being made are created using AI tools that often introduce additional vulnerabilities and weaknesses that adversaries might easily exploit in a downstream application, noted Breard.

The concern is that if the maintainers of the open source project are unable to address the issues, organizations will then create their own secure private forks of that code. The end result, however, would be a fracturing of an open source community in a way that might prove to be ultimately unsustainable, said Breard.

One way or another, a technical debt bill that many organizations have been ignoring for decades is now coming due. The issue now is finding the means to pay it off as quickly as possible without breaking the bank.

July 9, 2026
Anthropic Brings AI-Powered Security Scanning to Enterprise Teams With Claude Security

Anthropic has launched Claude Security in public beta for Claude Enterprise customers. The tool gives security teams a way to scan entire codebases for vulnerabilities — and generate targeted patches — without the usual back-and-forth that slows down remediation.

It’s a meaningful step forward for teams struggling to keep pace with the growing volume and complexity of security threats. And it signals where AI-assisted development is heading next.

From Research Preview to Public Beta

Claude Security isn’t brand new. Anthropic first released it as Claude Code Security in February, initially limited to Enterprise and Team customers. Since then, hundreds of organizations have used it in production, surfacing vulnerabilities that existing tools had missed — in some cases, for years.

That real-world feedback shaped what’s shipping today.

The public beta is now open to all Claude Enterprise customers globally. Access for Team and Max plan users is coming soon.

How it Works

Claude Security is powered by Claude Opus 4.7, Anthropic’s latest flagship model. What sets it apart from traditional static analysis tools is its approach to a codebase.

Rather than scanning for known patterns or signatures, it traces data flows, reads source code, and examines how components interact across files and modules — as a security researcher would. That reasoning-based approach means it can surface vulnerabilities that rule-based tools are likely to miss entirely.

Each finding undergoes a multi-stage validation pipeline before reaching an analyst. Every result comes with a confidence rating, severity level, likely impact, reproduction steps, and a recommended fix. Teams aren’t just getting a list of issues — they’re getting actionable intelligence.

From there, users can open a Claude Code session and work through the patch in context. No lengthy ticket queue. No waiting on a separate engineering review cycle. The goal is to go from scan to fix in a single sitting.

Since the research preview, Anthropic has also added scheduled scans for continuous coverage, the ability to dismiss findings with documented reasoning (so future reviewers can trust prior triage decisions), and CSV and Markdown export for integrating results into existing tracking and audit workflows.

Built for How Security Teams Actually Work

One of the more practical aspects of Claude Security is that it doesn’t require teams to abandon their current tooling. Findings can be exported in formats that plug directly into existing tracking systems. Dismissed findings carry documented context. Scheduled scans run in the background without requiring manual triggers.

That last point matters. Security teams are already stretched. A tool that runs independently and surfaces meaningful results — rather than generating noise — is far more likely to get adopted and used consistently.

According to Mitch Ashley, VP and practice lead for software lifecycle engineering at The Futurum Group, “Anthropic moving Claude Security to public beta collapses application security detection and remediation into one agent-driven workflow. Opus 4.7 reasoning across data flows, and component interactions compresses the scan-find-fix cycle into a single sitting, eliminating the ticket queue handoffs that defined traditional AppSec.”

“Pressure lands on vendors selling findings as the product. With endpoint and cloud security platforms embedding Opus 4.7 directly, the model layer is becoming a substrate for the security stack. Incumbents whose value lives in the detection-fix gap have to close it or lose the workflow.”

Part of a Broader Security Push

Claude Security doesn’t exist in isolation. It’s part of a wider effort by Anthropic to put advanced AI capabilities in the hands of defenders.

Opus 4.7 ships with safeguards that automatically detect and block requests indicating prohibited or high-risk cybersecurity uses. Those guardrails are built into the model itself, not bolted on as a filter. Anthropic has also launched a Cyber Verification Program for security professionals who need to use Opus 4.7 for legitimate purposes like vulnerability research, penetration testing, and red-teaming.

Alongside Claude Security, Anthropic launched Project Glasswing — an initiative focused on securing systemically important software and infrastructure. That program uses the company’s more restricted Mythos model, which is not publicly available and accessible only through a controlled consortium of technology partners.

Strong Partner Ecosystem From Day One

The public beta launch also comes with a notable list of integration partners. On the technology side, CrowdStrike, Palo Alto Networks, SentinelOne, Trend.ai, and Wiz are incorporating Opus 4.7 into their cybersecurity platforms. Service partners, including Accenture, BCG, Deloitte, Infosys, and PWC, are deploying Claude to help enterprise customers strengthen their overall security posture.

That partner network gives organizations options. Whether they want a standalone tool or something embedded in an existing platform they already rely on, there’s a path to adoption.

What This Means for DevSecOps

The core promise of DevSecOps has always been shifting security left — catching issues earlier in the development cycle, when they’re cheaper and faster to fix. In practice, that’s been harder than it sounds. Security reviews slow down pipelines. Findings pile up. Engineering and security teams operate in silos.

Claude Security doesn’t solve all of that. But it does address a real friction point: the gap between finding a vulnerability and knowing what to do about it. When a tool can identify a problem, explain it clearly, rate its severity, and help generate a fix — all in the same workflow — it changes the calculus for security teams.

Claude Security focuses on scanning an entire codebase with multiple agents running in parallel. While some tools look for known issues, Claude Security steps through source code and examines data flows to build a more complete picture of the attack surface.

That’s a meaningful capability — especially for organizations managing large, complex codebases where threats often hide in component interactions rather than isolated functions.

Claude Security is available now in public beta for Claude Enterprise customers. Access for Team and Max users is expected to follow.

May 1, 2026
Anthropic Launches Claude Sonnet 4.5: Built for Production Coding and Extended Autonomous Work

Anthropic released Claude Sonnet 4.5 today, positioning it as the best model available for real-world coding, agentic tasks and computer use. The company claims the model can operate autonomously for over 30 hours while maintaining consistent performance. This represents a significant improvement over the seven-hour capability of its predecessor, Opus 4.

The release comes roughly four months after Claude Sonnet 4, and Anthropic says the improvements go beyond benchmark scores. The focus here is practical utility: Better instruction following, stronger code refactoring and more production-ready output.

What’s Different About Sonnet 4.5

Claude Sonnet 4.5 leads on SWE-Bench Verified, a coding benchmark that tests how well models handle real-world software engineering tasks. But the model’s strengths extend into specialized domains.

In cybersecurity, it helps teams detect and remediate vulnerabilities faster. In financial services, it outperforms Opus 4.1 on research, modeling and forecasting tasks. And in legal workflows, Thomson Reuters reports that the model can analyze full litigation records and draft judicial opinions based on complex briefing cycles.

The extended autonomous operation window matters for teams building applications. Where earlier models would lose focus or require frequent intervention, Sonnet 4.5 can work through a full-stack build over multiple days without breaking stride. That consistency changes what’s possible when delegating complex architectural work to AI.

“Claude Sonnet 4.5 exemplifies how quickly we are shifting from AI as a coding assistant to AI as a reliable teammate that can own and complete entire streams of engineering and operations work,” according to Mitch Ashley, VP and practice lead, software lifecycle engineering at The Futurum Group. “Claude Sonnet 4.5 can now plan and execute multi-step tasks, including refactoring large codebases, navigating tools without APIs, or running complex security and data-analysis workflows without constant human intervention.”

Developer Tools and Infrastructure Updates

Alongside the model, Anthropic is shipping several updates aimed at developers building their own agents and workflows.

Claude Code receives a refreshed VS Code extension and terminal interface, featuring new checkpoint features. This allows developers to use Claude directly from their development environment, providing better state management.

The Claude Agent SDK provides teams with access to the same building blocks that power Claude Code — tools, context management and permissions frameworks. The idea is to enable companies to build custom agents without having to start from scratch.

Claude Developer Platform now supports longer agent runs through automatic context clearing and a new memory tool. This addresses a common pain point: Context window exhaustion during extended tasks.

Claude App can now execute code, create files, and analyze data. The feature is available across all paid plans and gets faster with Sonnet 4.5.

Early Customer Response

Companies using the model report measurable improvements over previous versions.

Replit saw its code editing error rate drop from 9% with Sonnet 4 to 0% with Sonnet 4.5 on internal benchmarks. Michele Catasta, President at Replit, noted that the model “balances creativity and control perfectly, thoroughly completing tasks without over-engineering.”

HackerOne reduced average vulnerability intake time by 44% while improving accuracy by 25% when using Sonnet 4.5 for security agents.

Netflix’s Eric Wendelin described the model as “excellent at software development tasks, learning our codebase patterns to deliver precise implementations.”

For Cursor, the improvements were most noticeable in longer-horizon tasks — those that require maintaining context and coherence across multiple files and systems.

Computer Use Capabilities

Anthropic introduced computer use capabilities about a year ago. With Sonnet 4.5, the company says Claude now leads the market in this area.

Computer use means the model can interact with applications and interfaces in the same way a human would: By clicking, typing and navigating menus. For DevOps teams, this opens up automation possibilities that go beyond traditional scripting. The model can work with tools that don’t have APIs or require complex visual navigation.

The practical application here is reducing manual overhead. Tasks that require jumping between systems or tools with different interfaces can be delegated to Claude, freeing up time for work that requires human judgment and expertise.

Industry-Specific Performance

The model shows particular strength in domains with complex requirements.

Norway’s sovereign wealth fund (NBIM) highlighted the combination of improved intelligence and direct integration with its tools and systems. Stian Kirkeberg, Head of AI and Machine Learning, called this “particularly powerful for our investment operations.”

Shopify’s Paulo Arruda described Sonnet 4.5 as “a powerful thinking partner: It builds detailed plans, grasps intent beyond words, and incorporates feedback thoughtfully.”

These use cases suggest the model handles context-heavy work better than previous versions; understanding not just what to do, but why, and adapting as requirements evolve.

What This Means for DevOps Teams

The 30-hour autonomous operation window changes the calculus for what you can delegate. Complex migrations, large-scale refactoring and multiservice updates become more feasible when you can rely on consistent performance over extended periods.

The combination of better coding ability, computer use skills and extended focus means fewer interruptions and less babysitting. That matters when you’re trying to ship faster without sacrificing quality.

And the new developer tools lower the barrier to building custom agents. If you need AI that understands your specific stack, workflows and constraints, you can now build that without extensive ML expertise.

Claude Sonnet 4.5 is available now through Anthropic’s API, Claude Code and the Claude app.

September 30, 2025
Qwiet AI Extends Microsoft Support in Platform for Fixing Vulnerabilities

Qwiet AI today extended the reach of its application security platform that uses artificial intelligence (AI) agents to discover and remediate vulnerabilities in code to now provide deeper integrations with Azure DevOps, Azure Boards and GitHub platforms from Microsoft.

The company has also enhanced its support for webhook notifications, automated data export processes, expanded secrets configuration and made minor user interface (UI) enhancements.

Additionally, Quiet AI is also beta testing observability graphs and reports to provide deeper vulnerability trend analysis.

Finally, the AutoFix AI agents developed by Qwiet AI to remediate vulnerabilities have also been extended to add an ability to analyze data stored in a Static Analysis Results Interchange Format (SARIF) for non-Code Property Graph projects and policy support for code built using the Swift programming language used to build macOS applications.

Quiet AI CEO Stuart McClure said integration with the DevOps platforms from Microsoft comes at a time when they are gaining increased traction. Many application developers are increasingly relying on artificial intelligence (AI) coding tools from Microsoft to build software, he added.

The challenge is that much of that code can contain vulnerabilities because the AI models that were relied on by AI coding tools were trained using examples of flawed code. Unfortunately, too many developers put too much faith in the output of AI coding tools. In some cases, the code created by an AI coding tool might be more secure than the code an inexperienced developer might create, but there is no way to tell without scanning it. The only way to address that issue at scale is to make use of an application security platform such as Qwiet AI that has trained AI agents to both discover vulnerabilities and automatically remediate them, said McClure.

It’s not likely that concerns about vulnerabilities might be holding back adoption of AI coding tools so it’s probable the number of them that will find their way into production environments is only going to increase. The best way to proactively address that issue is to use AI to identify and remediate vulnerabilities as code is being written, added McClure.

In the case of Qwiet AI, that means using a platform that makes use of AI agents to run both static assessment security test (SAST) and software composition analysis to discover vulnerabilities that are then remediated using a series of AI agents that create, test and review changes that will be made to the code. In effect, Qwiet AI is making a case for using AI agents to compensate for the security flaws in AI coding tools.

Hopefully, the code being generated by AI coding tools will steadily improve as they are trained using examples of code that have been vetted for security flaws. In the meantime, however, DevSecOps teams should view any code generated by AI coding tools with at least the same level of suspicion as they would code written by human developers.

August 27, 2025
Rezilion Launches Vulnerability Prioritization Platform

Rezilion today announced general availability of a platform that enables DevOps teams to better prioritize remediation efforts by identifying which vulnerabilities both run in memory and actually impact a class or function that can be executed.

Liran Tancman, Rezilion CEO, said the biggest DevSecOps challenge organizations face today is that the bulk of vulnerabilities that developers are tasked with remediating don’t constitute a significant cybersecurity threat.

Rezilion has created a searchable proprietary next-generation vulnerability database (NGVDB) that identifies which issues impact specific classes and functions. That capability enables DevOps teams to de-prioritize close to 95% of software vulnerabilities, said Tancman.

In addition, the Rezilion platform will surface remediation suggestions that lower the amount of disruption and/or cost, he said. A fully-automated remediation capability, for example, will automatically upgrade and test vulnerable software components and packages within a continuous integration (CI) pipeline that were found to be exploitable. In the longer term, Rezilion is also working toward surfacing remediation suggestions that might be addressed using an alternative to patching, said Tancman.

The Rezlion platform is also integrated with IT service management platforms such as ServiceNow and project management tools such as Jira to make it easier to address vulnerabilities as part of existing workflows, he added.

Most developers today are simply overwhelmed by the number of vulnerabilities that cybersecurity teams routinely ask them to patch, noted Tancman. The goal should be to enable developers to focus their limited time and effort on remediating the vulnerabilities that truly matter to ensure application security, he said.

In addition, developers need to have more confidence in the fact that the patch they are being asked to make won’t break their existing applications, added Tancman.

Vulnerability prioritization is, of course, at the heart of the long-standing divide that exists between DevOps and cybersecurity professionals. Spreadsheets filled with long lists of vulnerabilities are regularly created, but there is usually no context provided in terms of how severe a threat any given vulnerability poses. As a result, developers would allocate a small portion of their time to applying patches that are prioritized based on intuition and level of complexity rather than severity.

Naturally, developers are going to allocate most of their time to creating new applications and features. For any DevSecOps initiative to succeed, it’s critical to ensure optimal use of the time allocated to remediation. Cybersecurity teams will continue to compile lists of vulnerabilities, but that list can now be triaged in a way that causes the least amount of friction.

In the wake of a series of high-profile security breaches, there is now more focus than ever on securing software supply chains. The challenge is to find a way to better secure applications both before and after they are deployed in a production environment. There will always be vulnerabilities that are discovered after an application has been deployed. However, just because a vulnerability exists, that doesn’t mean it’s exploitable. The trouble with application security today is that, all too often, remediation efforts turn out to be a waste of time.

July 12, 2022
Vulcan Cyber Research Reveals Most Enterprise Cybersecurity Teams Lack the Ability to Remediate Risk
Benchmark study finds most cybersecurity organizations lack the tooling and resources to deliver enterprise cyber hygiene

TEL AVIV, Israel — May 12, 2021 — Vulcan Cyber®, developers of the industry’s only risk and vulnerability remediation platform, today released the results of its latest vulnerability remediation maturity research project. A survey of more than 100 enterprise security executives across North America and EMEA found that most enterprise cybersecurity and vulnerability management organizations lack the ability to drive remediation initiatives, to reduce risk and achieve acceptable levels of cyber hygiene. Vulcan Cyber is using the benchmark data from this research to provide cybersecurity leaders with a free vulnerability remediation maturity self-assessment service.

Conducted by Pulse, the Vulcan Cyber vulnerability remediation maturity survey examines the maturity of enterprise vulnerability remediation programs while seeking to identify where shortcomings exist within respondents’ cyber hygiene efforts. According to the findings, 56% of organizations lack the ability to remediate vulnerabilities with speed and at the scale necessary to protect business from exploits and hackers. Immature cybersecurity teams typically react to vulnerabilities on a case-by-case basis. Additionally, nearly 80% of respondents do not have the proper tooling to proactively orchestrate and automate vulnerability remediation.

“Enterprises must work to get ahead of the relentless barrage of known security vulnerabilities that increasingly threaten business. Development, IT operations and security teams should be able to coordinate and measure their efforts to remediate vulnerabilities quickly and at scale,” said Yaniv Bar-Dayan, Vulcan Cyber CEO and co-founder. “To be effective, it takes the right people, processes and tools. If anyone is lacking, it is close to impossible to drive meaningful remediation outcomes. It is no small task to get fix done so we are doing all we can to make vulnerability scanning and vulnerability prioritization freely available to all cybersecurity teams.”

Key findings from the Vulcan Cyber study include:
- Only 21% of enterprises have the proper tooling to proactively manage and automate vulnerability remediation. While only one-third (34%) of respondents reported having a defined, effective process for detecting and responding to vulnerabilities, one-third (33%) lack an effective or comprehensive process entirely.
- Forty-four percent of survey respondents only rely on the criticality of a vulnerability and the available bandwidth of IT and security teams to determine how quickly to remediate a vulnerability—and less than one-quarter (21%) are proactively remediating as quickly as possible.
- Nearly one-third (31%) of respondents admitted their organizations do not prioritize vulnerabilities at all. The most mature organizations use a combination of inputs from CVSS scores, threat intelligence, and risk to business assets to prioritize vulnerabilities, but this was only 26% of enterprises.
- Forty-six percent of survey respondents either don’t measure vulnerability risk at all, or rely on “gut feel.”
“As organizations become more mature in their vulnerability remediation efforts, it is possible to become substantially more efficient, while increasing the scale of cyber hygiene coverage,” said Bar-Dayan. “It requires all stakeholders – security, IT operations, engineering, and business unit owners – to align objectives and orchestrate tooling to create optimized and automated remediation workflows. We are working to change the economics of risk operations and vastly improve enterprise cyber hygiene.”

Vulcan Cyber has made it easy for organizations to assess their vulnerability remediation maturity levels using its new security self-assessment tool. For additional guidance on how to benchmark current practices and outcomes against using the Vulcan Vulnerability Remediation Maturity Model, read the Vulcan Cyber eBook titled, The Four Levels of Mature Vulnerability Remediation.

For more information about Vulcan Cyber, please visit https://vulcan.io/ to request a demo, or try Remedy Cloud today. In addition, Vulcan Free is now available as the industry’s only free vulnerability prioritization tool. Apply for Vulcan Free access today.

About Vulcan Cyber

Vulcan Cyber has developed the industry’s first risk and vulnerability remediation platform, built to help businesses reduce cyber risk through measurable cloud and application security. The Vulcan platform orchestrates and tracks the remediation lifecycle from scan to fix by prioritizing vulnerabilities, curating and delivering the best remedies, and automating processes and fixes through the last mile of remediation. Vulcan Cyber helps IT security teams collaborate and “get fix done” at scale. Vulcan Cyber is proud to offer Remedy Cloud and Vulcan Free as freemium SaaS solutions for businesses of all sizes. The unique capability of the Vulcan Cyber platform has garnered Vulcan Cyber recognition as a 2019 Gartner Cool Vendor and as a 2020 RSA Conference Innovation Sandbox finalist. https://vulcan.io
May 12, 2021