HackerOne Report Finds Vulnerability Backlogs Grew 131% in Two Years | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

HackerOne, a global leader in Continuous Threat Exposure Management (CTEM), today released its 10th annual HackerOne Security Research Report, finding that the backlog of validated, unresolved vulnerabilities on the H1 Platform grew 131% over two years.
The report, “Exposure Debt: The Next Challenge in Cybersecurity,” found that the increase occurred even as organizations reduced the average time needed to resolve vulnerabilities from 135 days to 62 days, a 54% improvement. Security teams are fixing vulnerabilities faster, but new findings continue to arrive faster than teams can address them.
HackerOne describes the growing backlog as “Exposure Debt,” which refers to validated vulnerabilities an organization knows about but has not resolved. Nearly 70% of surveyed security leaders said findings are entering their systems faster than their teams can remediate them, while 75% said their organizations formally track exposure debt.
AI-assisted vulnerability research is contributing to the increase in findings. Researchers are using AI to automate tasks such as reconnaissance and report writing, giving them more time to investigate authorization flaws, multi-step attack chains and other vulnerabilities that require context and human judgment.
According to the report, 85% of surveyed researchers are developing their AI skills, and nearly three-quarters said using AI has meaningfully increased their valid findings. Another 68% said they have moved toward more complex vulnerabilities with higher bounty awards.
“AI is changing both sides of the security equation. It’s helping researchers find vulnerabilities faster and go deeper, while representing entirely new attack surfaces for them to test,” said Kara Sprague, CEO of HackerOne. “At the same time, nearly 70% of security leaders say findings are piling up faster than their teams can address them. Fixing got faster. It still lost ground. The constraint is no longer discovery; it is everything between a report arriving and a risk being resolved.” 
AI vulnerability reports are also changing as systems connect to external tools, data sources and business processes. Reports involving system prompt leakage increased 557% year over year, while misinformation reports rose 455% and improper output handling increased 264%. Prompt injection and sensitive information disclosure remained the two most commonly reported AI vulnerability categories on the platform.
“AI hasn’t replaced how I think as a security researcher. It’s changed how much ground I can cover,” said Douglas Day, a top-earning security researcher on HackerOne. “I’ve automated parts of my research process that used to take hours, which gives me more time to focus on the vulnerabilities that require creativity, context, and an understanding of how systems actually work. The researchers who get the most out of AI won’t be the ones who simply turn it on. They’ll be the ones who know how to guide it, question it, and recognize when it has found something worth pursuing. The most valuable skill in the age of AI will be the ability to be flexible and adapt to new tools and technologies as they become available.”
Researchers earned a record $89 million through bug bounty programs on the H1 Platform between July 2025 and June 2026. That represents an 18% increase from the previous year and the highest annual total recorded on the platform.
The report recommends that security leaders pair continuous vulnerability discovery with stronger validation, prioritization and remediation processes. Organizations can also track the age and severity of their backlogs, assign clear ownership for validated findings and expand testing to cover AI and agentic systems.
The report draws on aggregated and de-identified H1 Platform data from July 2025 through June 2026. It also includes surveys of 111 security leaders at organizations with more than $100 million in annual revenue across six countries and 408 active HackerOne security researchers. The security leader survey included HackerOne customers and noncustomers.

Join our LinkedIn group Information Security Community!

——————————————————-
Click Here For The Original Source.

Related