Large enterprises are increasingly struggling to manage their vulnerability backlogs, with nearly half of organizations employing 5,000 or more staff members admitting to closing or deprioritizing security findings without conducting a full verification process. According to data from ProjectDiscovery, the primary driver for this behavior is a lack of time, as security teams find themselves overwhelmed by the sheer volume of alerts generated by a growing array of testing tools.
The scale of the problem is significant, with most large enterprises currently managing more than 1,000 untriaged findings. Approximately 25% of these organizations report backlogs exceeding 10,000 items. This trend is particularly pronounced in large firms compared to smaller companies, where such massive accumulations of unverified vulnerabilities are less common.
The pressure to clear these backlogs is intensified by the shrinking window of time available to defenders. Data from Mandiant indicates that the average time taken by attackers to exploit a vulnerability has dropped precipitously, falling from 63 days in 2018 to just seven days in 2025. This acceleration leaves security teams with little margin for error, yet the process of separating legitimate threats from false positives remains labor-intensive.
While many security professionals acknowledge that a portion of their backlog consists of noise, the difficulty lies in identifying which alerts are genuine. Surveyed teams report that at least 10% of their findings are typically fake or unexploitable, with over one-third of respondents estimating that more than 25% of their alerts fall into this category. However, among teams that do take the time to verify their findings, 57% report that at least three out of four alerts are confirmed as real, suggesting that a significant portion of the unverified backlog likely contains actionable security risks.
The complexity of modern security environments exacerbates the issue, as 70% of teams aggregate findings from three or more disparate sources, including automated scanners, bug bounty programs, penetration tests, and customer reports. Because each source may describe the same vulnerability differently, organizations often designate a single tool as their "source of truth." This practice frequently leads to findings from other sources being ignored or closed without proper review. Teams managing five or more sources are nearly twice as likely to skip verification compared to those relying on one or two.
There is a notable disconnect between security leadership and the practitioners performing the daily triage. More than half of security leaders admit to closing or deprioritizing unverified findings, compared to only about one-third of the practitioners. This indicates that those responsible for signing off on organizational risk are more willing to accept the uncertainty of an unverified backlog than those tasked with the actual investigation.
Despite the prevalence of this practice, it remains a source of anxiety for the industry. Nearly 90% of teams that admit to cutting corners in the verification process express concern that actual vulnerabilities are being overlooked. This worry is shared by the broader security community, even among those who do not routinely skip verification steps. Furthermore, half of all respondents believe that simply hiring more personnel would not solve the underlying issue.
Artificial intelligence is playing a dual role in this crisis. On one hand, nearly half of the respondents report that AI-driven testing tools are increasing the volume of findings, further bloating backlogs. On the other hand, just over one-third of teams are utilizing AI to accelerate the triage process. These teams report a higher level of confidence in their vulnerability management, though it remains unclear whether the tools are directly responsible for the improved performance or if more capable teams are simply the early adopters of such technology.
Looking ahead, the threat landscape is expected to grow more challenging as attackers increasingly adopt AI to identify and exploit vulnerabilities before security teams can address them. More than half of the surveyed professionals expect that adversaries will reach the issues currently sitting in their backlogs before they have the opportunity to verify or remediate them.
