- Chainguard's survey of 1,300 security leaders found 66% at $1bn+ companies sometimes leave high or critical flaws unpatched, against 27% at firms under $250m.
- Large firms more often cite business trade-offs and disruption. Smaller firms more often cite the difficulty of testing patches.
- Leaders should ask who may accept patch risk, and why bought security tools are not yet deployed.
An unpatched system is often seen as an oversight. A new survey points to something different. Security leaders at large companies say they sometimes leave serious flaws open, and they name business reasons for it.
What the survey found
Software supply chain security firm Chainguard released the study on October 14 at its Assemble London event. Wakefield Research ran it online in September 2026. It covered 1,300 cybersecurity leaders across 10 markets, including the US, UK, Germany, Japan and Saudi Arabia.
Respondents were director level or above. They worked at companies with at least 500 employees. In Singapore, the UAE and Saudi Arabia the minimum was 250.
For companies under $250m in revenue, the same figure was 27%. Large firms were more than twice as likely to say they at least sometimes knowingly leave serious flaws open.
Two companies, two different problems
The stated barriers differ by size. Among large firms, 48% said patching is too disruptive to operations. Another 46% said revenue-generating work takes priority.
Smaller firms named a different barrier. 59% said they struggle to test patches.
Why patching a serious flaw is not a quick job
This section is general context, not a survey finding. A patch changes software that is already running. Other systems may depend on the old behavior, so a fix for one flaw can break something else.
Teams therefore test a patch before they roll it out. That means checking that the system still works as before, often in a copy of the live environment. Then they pick a maintenance window, a planned time when a system can be restarted or taken offline.
For a system that earns revenue, even a short outage has a cost. That is a trade-off. A small team may simply lack the people or test setups to finish the checks. That is a capacity problem.
That split matters. The large-firm answers describe trade-offs. The small-firm answers describe capacity.
The survey does not say why large firms find patching more disruptive. One reasonable reading is that more interlinked systems make each change riskier. That is our interpretation, not a finding.
The lesson here is that one patching policy may not fix both problems. Extra testers may not help a large firm if the real block is a business unit that refuses a maintenance window.
Buying is easy; deploying is not
Respondents say money for AI-threat defense is not hard to find. 70% said securing budget for this purpose is easy.
Even so, the tools do not always reach use. Nearly four in ten respondents own security products that are still not deployed. Only 22% rate their tools as "very effective".
Even among those who call their tools very effective, 77% still expect an exploit within a year. Almost half of all respondents (48%) say their investments fall short of what boards and executives expect.
The 70% figure covers all respondents and concerns AI-threat defense. The survey does not test whether budget explains the gap in patching between large and small firms.
The people carrying the load
The survey also describes strain. Chainguard reports that 64% of leaders trace some of their own burnout over the past year, at a moderate or greater level, to attacks sped up by AI. Nearly all (96%) said team burnout affects their ability to defend against AI threats.
A majority also expect that, within a year, AI tools that find software flaws will regularly work faster than their teams can respond. That is a forecast by respondents, not a measurement.
Their responses so far are practical. 51% moved staff onto remediation. 50% adopted secure-by-default software components. 47% cut third-party dependencies. 42% scan more often.
Read the numbers with care
Chainguard sells software supply chain security and commissioned the study. The answers are self-reported by leaders, not measured from their systems. "At least sometimes" is a broad bar. The study also does not cover very small firms, since every respondent worked at a company of at least 250 or 500 employees.
Questions to put to your team
First, who is allowed to accept the risk of leaving a high or critical flaw open? Is that decision written down, with an owner and an end date?
Second, which systems are treated as too disruptive to patch? Can they be redesigned so a fix does not threaten revenue?
Third, what is the test capacity? If patches wait on testing, that is a staffing question you can fund.
Fourth, which purchased tools are not yet deployed, and what is blocking them?
An unpatched flaw is a risk someone has agreed to carry. The survey cannot say who owns these decisions, but the pattern of trade-off answers is a reason to ask.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Infosecurity Magazine.
