Chainguard Research: Nine in Ten Security Leaders Say AI Attacks Have Changed Their Job More Than Anything in a Decade, but the Ability to Act Hasn't Kept Pace

Survey of 1,300 security leaders finds 77% expect an attacker to exploit a vulnerability at their organization in the next year, while 54% say their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes

KIRKLAND, Wash., Oct. 14, 2026 /PRNewswire/ -- Chainguard, the trusted source for open source, today released The AI Exploit Gap, a global report surveying 1,300 security leaders, that explores the widening distance between how fast AI-powered tools can find and chain vulnerabilities and how fast human teams can fix them. Nine in ten (91%) security leaders say AI-accelerated attacks have changed their job more than anything else in the past decade, and 77% believe it is likely an attacker will exploit a software vulnerability at their organization within the next 12 months. Yet 54% acknowledge their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes, a sign that the ability to act hasn't kept pace with the speed of change.

AI is expanding risk, and leaders are feeling it

The same technology making engineers faster is also making defenders' jobs harder, and the pressure is landing on security leaders personally. Over half say burnout is affecting their team's ability to defend against those same threats. Security teams are facing a triple threat: frontier AI models finding vulnerabilities faster than ever, attackers using the same tools to exploit them, and supply chain attacks bringing in risk from outside the organization. Regulations, such as the EU Cyber Resilience Act and Product Liability Directive, are also adding to the pressure by raising the cost of leaving known vulnerabilities open. While engineering teams are on the frontlines of vulnerability remediation, security leaders, who are held responsible when a vulnerability is exploited, are often caught in the middle.

"AI has changed the security job faster than anything else in the past decade, and security leaders can see exactly where it's heading. Most we talked to expect an attacker to exploit a vulnerability in their organization this year," said Quincy Castro, Chief Information Security Officer, Chainguard. "But seeing the risk and being able to act on it are two different things. AI can find and chain flaws in minutes, while fixing them still moves at human speed and competes with product deadlines and uptime. That's the AI exploit gap, and it hits security and engineering teams in the areas where many historically struggled prior to AI. Thinking you'll just patch faster is the Red Queen talking. Patching faster isn't viable for most folks and it will consume increasing amounts of resources just to keep pace. The way out is for engineering and security to own the problem together and make prevention the standard, instead of just trying to run twice as fast."

Where the gap is widening

The data shows that many organizations view exploitation as probable even when leaders have confidence in their security programs. Among respondents who rated their cybersecurity tools as very effective, 77% still expected an attacker to exploit a vulnerability in the next year. The same was true for 78% of leaders who considered their incident response teams very equipped to handle AI-driven attacks, and 77% of those who said investments had stayed ahead of the threat. Other key findings include:

The findings show security leaders aren't short on awareness or budget. What's missing is the ability to act at the speed AI now demands. Closing the AI exploit gap means treating prevention as the standard and making remediation a shared responsibility between engineering and security, so fewer vulnerabilities reach production in the first place.

Read the complete research findings here.

Methodology

This survey was commissioned by Chainguard and conducted by Wakefield Research, a third-party research partner, to collect responses from 1,300 cybersecurity leaders globally. Respondents were chosen from a variety of industries, and organization sizes and revenues. All respondents had a minimum seniority of Director, and worked for companies with at least 500 employees (except in Singapore and UAE/Saudi Arabia, where the minimum was 250 employees). Respondents were chosen from nine markets: U.S., U.K., France, Germany, Brazil, Singapore, Mexico, UAE/Kingdom of Saudi Arabia (KSA), and Japan, in September 2026, using an email invitation and an online survey.

About Chainguard

Chainguard is the trusted source for open source. By providing engineers and AI agents with hardened, trusted, and production-ready artifacts, Chainguard helps organizations prevent AI supply chain attacks, increase engineering velocity while reducing toil, and maintain continuous compliance. Customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, DocuSign, OpenAI, Public Storage, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. For more information, visit: https://www.chainguard.dev/

Contact:

Brittany Hendrickson

[email protected]

SOURCE Chainguard