The AI exploit gap is engineering’s problem now

A survey of 1,300 security leaders commissioned by Chainguard and conducted by Wakefield Research found that 77% expect an attacker to exploit a software vulnerability at their organization within the next 12 months, while 54% say their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes. The report, "The AI Exploit Gap," defines that gap as the distance between how fast AI tools can find and chain vulnerabilities and how fast human teams can fix them, with 93% of respondents worried their companies cannot remediate AI-driven exploits fast enough. Chainguard CISO Quincy Castro said patching faster will not close the gap, arguing that "thinking you'll just patch faster is the Red Queen talking" and that prevention must become the standard.

This is your last article that you can read this month before you need to register https://leaddev.com/register a free LeadDev.com account. Estimated reading time: 2 minutes Key takeaways: - Fixing vulnerabilities , not finding them, is the bottleneck. - Patches stall on engineering constraints like testing and disruption . - Prevention beats patching faster. A survey of 1,300 security leaders finds that finding vulnerabilities is no longer the hard part. Fixing them is, and that work lands on engineering teams https://leaddev.com/ai/designing-human-agent-engineering-teams . More than three-quarters 77% of security https://leaddev.com/culture/why-security-everyones-responsibility leaders expect an attacker to exploit a software vulnerability at their organization in the next 12 months. Meanwhile, 54% say their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes. Those figures come from The AI Exploit Gap, https://www.prnewswire.com/news-releases/chainguard-research-nine-in-ten-security-leaders-say-ai-attacks-have-changed-their-job-more-than-anything-in-a-decade-but-the-ability-to-act-hasnt-kept-pace-302907743.html a report commissioned by Chainguard and conducted by Wakefield Research. It surveyed security leaders at director level or above, at companies with 500 or more employees. The report defines the AI exploit gap as the distance between how fast AI tools https://leaddev.com/ai/best-ai-coding-assistants can find and chain vulnerabilities and how fast human teams can fix them. Your inbox, upgraded. Receive weekly engineering insights to level up your leadership approach. Better tools don’t lower expectation Budget is not the obstacle: 70% of those polled say securing money for AI-driven threat defense is easy. Yet 39% have bought tools they haven’t rolled out, and only 22% rate their tools “very effective.” Among that 22%, 77% still expect an exploit this year. Some 93% of respondents worry their companies can’t fix AI-driven exploits fast enough. That fix is engineering https://leaddev.com/technical-direction/software-engineering-with-genai work like changing code, testing it, and shipping it. The AI exploit gap lives in the patch queue Larger companies leave known problems open more often. At companies with $1 billion or more in revenue, 66% say they leave high or critical vulnerabilities unpatched at least sometimes, against 27% at companies under $250 million. Large companies cite disruption to operations 48% and revenue-generating work taking priority 46% . Smaller companies cite difficulty testing patches 59% . Both are engineering problems https://leaddev.com/technical-direction/ai-made-platform-engineering-strategic-again because a patch that can’t be tested safely, or shipped without disruption, waits behind the roadmap. Prevention moves into build decisions Teams are already changing how they work, with 50% having adopted secure-by-default components and 47% cutting their third-party dependencies. Chainguard’s CISO Quincy Castro says patching faster won’t close the gap. “Thinking you’ll just patch faster is the Red Queen talking,” he says. “Patching faster isn’t viable for most folks and it will consume increasing amounts of resources just to keep pace.” More like this The way out is for engineering and security https://leaddev.com/series/removing-barrier-between-security-and-engineering to own the problem together and make prevention the standard, instead of just trying to run twice as fast, Castro adds. Berlin • November 9 & 10, 2026 Close the gap between what leadership expects and what’s actually possible at LeadDev Berlin . Urgency tracks with exposure Among leaders who believe AI already outpaces human remediation, 20% say they leave critical vulnerabilities unpatched at least sometimes. That rises to 50% among those who expect it to within a year and 64% among those who think the shift is more than a year away. Almost every respondent wants senior leaders https://leaddev.com/leadership/behind-curtain-two-sides-senior-leadership to show more urgency. The survey shows a link, not a cause. Still, teams that treat the problem as urgent now fix more of it. Tools https://leaddev.com/ai/your-ai-coding-tools-buying-checklist-for-2026 won’t close this gap on their own. It closes in your delivery pipeline: how fast a critical patch gets tested and shipped, who can move it ahead of the roadmap, and how many dependencies you carry that you’ll have to patch later. Security leaders can see the problem, but engineering controls the fix. Ask your team how long a critical patch takes to reach production and who decides when it jumps the roadmap. If nobody can answer, you’ve found your gap.