2026 State of Vulnerabilities
What 11,646 vulnerabilities reveal about the AI-era attack surface. Volume held steady in 2025, but 37% of findings were critical or high, and the window between disclosure and exploitation kept closing.
The encouraging number is on the other side of the ledger. Synack customers cut mean time to remediate by 47%, closing criticals in 38 days instead of 63.
2025 by the numbers
Drawn from 11,646 vulnerabilities found for Synack customers during 2025, compared with the same measures in 2024.
37% critical or high
Of the 11,646 vulnerabilities found in 2025, 37% were rated critical or high severity. High severity findings rose 10% year over year while medium and low both declined.
47% faster remediation
Mean time to remediate fell by an average of 47% across all severity levels. Critical findings closed in 38 days, down from 63 the year before.
120% more AI testing
Synack customers launched 120% more AI and LLM security missions in 2025 than in 2024, as AI systems became an active testing priority rather than a future one.
Stable volume is not the same as stable risk
Most vulnerability metrics in 2025 tracked closely with 2024. Volume and density held roughly flat, which on its own reads as a good sign. The wider picture complicates it. Published CVE records reached 48,244 in 2025, a 20% increase year over year according to cve.org, so a flat finding rate against a faster-moving backdrop means posture is keeping pace rather than falling behind.
The severity mix carries the rest of the story. Critical findings edged down from 1,909 to 1,817 and medium from 6,992 to 6,764, while high severity rose from 2,265 to 2,495, a 10% increase. Low severity declined again to 570. Fewer low and medium findings alongside more high severity ones is a pattern that shows up consistently in mature programs, which tend to generate less noise.
What changed most is time. The gap between a vulnerability becoming known and becoming exploitable narrowed through the year, which means the same number of findings now represents more exposure than it did twelve months ago. Risk is a function of how fast a weakness can be found and used, not only of how many weaknesses exist.
Old vulnerability classes, new urgency
Cross-site scripting is still the most frequently found vulnerability across the Synack platform, with authorization and permissions issues second. Both declined year over year, which suggests that investment in secure coding practice and consistent code review is producing results in the categories it targets.
Three categories moved the other way. Remote code execution grew 39% year over year, brute force attacks 17.4% and content injection 8%. Together they point toward social engineering, identity-based exploitation and supply chain weaknesses, and toward authentication boundaries being probed systematically rather than opportunistically.
Mapped against the OWASP Top 10:2025 categories, injection accounted for 40.6% of Synack findings in 2025 and broken access control 32.8%. Security misconfiguration was 13.5%, identification and authentication failures 8.1% and insecure design 5.0%. The 2025 OWASP Top 10 for LLMs adds categories that matter for organizations running AI-integrated applications, including excessive agency, system prompt leakage, and vector and embedding weaknesses. AI infrastructure does not replace the traditional attack surface. It extends it.
Remediation got nearly twice as fast
Synack customers closed critical vulnerabilities in an average of 38 days in 2025, down from 63 in 2024. High severity findings fell further in absolute terms, from 100 days to 58. Medium dropped from 111 days to 62 and low from 143 to 82. Averaged across all severity levels, mean time to remediate fell 47%.
Two forces are likely behind it. Teams are feeling the pressure of a shorter average time to exploit and are prioritizing the close of critical windows. And platform-delivered testing lets teams correlate vulnerability data across assets and business units, which improves prioritization and reduces the administrative drag between finding something and fixing it.
The benchmark has moved, though. A remediation time measured in days was a reasonable target in 2023. It is a weaker one against adversaries using AI-assisted reconnaissance and commercial exploit tooling to compress the interval between disclosure and exploitation.
How five industries compare
Share of findings rated critical or high in 2025, against an overall average of 37.3%.
Manufacturing
The sharpest remediation improvement of any sector, cutting critical remediation by 43 days and high severity by 78. Findings rose 37% to 666 as OT and IT converge and more connected devices come into scope.
Technology
2,637 findings, up 14%. Mixed remediation: high severity improved from 122 days to 109, but critical extended from 74 to 98, which suggests the criticals being surfaced need deeper architectural fixes.
Government
Critical remediation cut by 34 days, from 86 to 52, and high severity by 25, from 97 to 72. Findings rose 10% to 697 as agencies brought more assets into scope.
Retail
Findings fell 10% to 1,270, but the critical and high share climbed from 30.2%. High severity remediation improved by 18 days, to 42, while critical extended from 26 days to 37.
Financial services
One of the strongest remediation performances of any sector: critical down 19 days to 36, high down 30 days to 57. Findings fell 6% to 3,215 while the critical and high share rose from 28.6%.
SQL injection and RCE
Technology accounted for the largest share of critical SQL injection findings at 34.9%, then financial services at 31.5%. Critical RCE was spread more evenly, led by financial services at 26.8%.
The coverage gap behind the numbers
Average total assets grew or held steady across four of the five industries in 2025. Manufacturing saw the sharpest increase at 21%, from 2,053 to 2,486 assets per organization. Retail was the exception and declined slightly. Subdomains remain the dominant asset type by volume at roughly 40,000 per organization, and web application counts grew modestly, consistent with the faster development cycles that AI coding assistants enable.
Set against that, Synack research with Omdia found that organizations test about 32% of their attack surface on average. At those subdomain counts, the remaining 68% is thousands of untested assets per organization, each one a place an AI-assisted adversary can look without being watched. Synack's own State of Continuous Security Validation research points the same way: 38% of organizations carry a quarter or more of their attack surface untested at any given moment.
Zero-days make the gap concrete. When React2Shell (CVE-2025-55182) was disclosed, allowing unauthenticated attackers to reach remote code execution through a crafted HTTP request, Synack ran 53 on-demand CVE checks across 14 potentially affected customers within days, and checked for it across 348 Synack365 assessments. That response depends on knowing what you have and being able to test it on demand.
Matching the pace of AI-enabled adversaries
The answer to faster attackers is broader coverage at higher frequency, without giving up the judgment that separates a finding from a proven exploit.
Sara, the Synack Autonomous Red Agent
In one recent six-hour session with no human intervention, Sara found and fully exploited a SQL injection, an admin account takeover and a stored cross-site scripting flaw on a live application. 70% of its findings on that target were rated high or critical.
The Synack Red Team
Vetted researchers pursue the business logic flaws, chained attack paths and emergent behaviors that automated scanning misses, and confirm what an adversary could actually do with a finding.
Continuous, not periodic
Organizations that test continuously across the full attack surface close findings faster and surface higher-severity issues earlier in the exposure window. Periodic testing means operating on incomplete information between assessments.
About the data
Synack analyzed proprietary vulnerability data covering all organizations that tested with Synack during 2025, and compared it with 2024 data across vulnerabilities by industry vertical, the distribution of criticality and average time to remediation. Because vulnerabilities can take months to close, remediation figures continue to move after a reporting period ends. Attack surface discovery statistics are drawn from a wider dataset that includes prospective as well as current customers. The 48,244 published CVE figure is from cve.org.
The report was published in May 2026 with a foreword by Dr. Mark Kuhr, Synack co-founder and CTO. For the capability side, see AI pentesting and continuous penetration testing.
Questions about the report
What share of vulnerabilities found in 2025 were critical or high severity?+
37% of the 11,646 vulnerabilities Synack found for customers in 2025 were critical or high severity. Across the five industries in the report the overall average was 37.3%. Manufacturing was highest at 43.1%, followed by technology at 40.0% and government at 39.4%. Retail at 32.4% and financial services at 31.4% fell below the average.
How long does it take to remediate a critical vulnerability?+
Synack customers remediated critical vulnerabilities in an average of 38 days in 2025, down from 63 days in 2024. High severity findings fell from 100 days to 58, medium from 111 to 62 and low from 143 to 82. Mean time to remediate dropped by an average of 47% across all severity levels.
Which vulnerability types are growing fastest?+
Three categories grew in 2025: remote code execution rose 39% year over year, brute force attacks 17.4% and content injection 8%. Cross-site scripting remains the most frequently found vulnerability overall, with authorization and permissions second, but both declined year over year.
How do Synack findings map to the OWASP Top 10?+
Across the OWASP Top 10:2025 categories, injection accounted for 40.6% of Synack's 2025 findings and broken access control 32.8%. Security misconfiguration was 13.5%, identification and authentication failures 8.1% and insecure design 5.0%.
How much of the attack surface is actually tested?+
Synack research with Omdia found that organizations test about 32% of their attack surface on average. With subdomain counts averaging roughly 40,000 per organization, that leaves thousands of untested assets per organization. Synack's State of Continuous Security Validation research found that 38% of organizations carry a quarter or more of their attack surface untested at any given moment.
What data is the report based on?+
Synack analyzed proprietary vulnerability data for all organizations that tested with Synack in 2025 and compared it with 2024 data, covering vulnerabilities by industry vertical, the distribution of criticality and average time to remediation. Attack surface discovery statistics are drawn from a wider dataset that includes prospective as well as current customers. Because vulnerabilities can take months to close, remediation figures continue to move after the period ends.
Get the full report
Thirty-six pages on the 2025 vulnerability landscape: severity mix and how it shifted, remediation times by severity, the vulnerability types growing and declining, how findings map to the OWASP Top 10, and sector detail for retail, financial services, government, technology and manufacturing. No form, no email required.