HackerOne, a pioneer in Continuous Threat Exposure Management (CTEM), today released its 10th annual HackerOne Security Research Report, revealing that on the H1 Platform, the backlog of validated, unresolved vulnerabilities grew 131% in two years, even as average resolution time improved 54%. This year's report, Exposure Debt: The Next Challenge in Cybersecurity, introduces the urgent challenge security teams are grappling with in the race to stay ahead of attackers.
AI has changed what security researchers can find. In skilled hands, advanced models are surfacing authorisation flaws and multi-step attack chains that traditional scanners often miss. Organisations are responding: the average resolution time improved 54% this year, but discovery is outpacing remediation, and the gap between them continues to widen. Every vulnerability an organisation knows about and hasn't fixed is a risk it already owns and hasn't paid down. That's Exposure Debt, and it grew 131% in just two years.
