Vulnerability Backlogs Grew 131% Even as Fixes Got Faster

The backlog of validated, unresolved vulnerabilities on HackerOne's platform grew 131 percent over two years, even as average resolution time improved by 54 percent, according to the company's 2026 Security Research Report.

Average resolution time fell from 135 days to 62 days, but nearly 70 percent of surveyed security leaders said new findings were arriving faster than their teams could fix them. HackerOne calls the resulting accumulation “exposure debt.”

AI-related vulnerability reports rose 53 percent year over year. System prompt leakage increased 557 percent, misinformation 455 percent and improper output handling 264 percent. Eighty-five percent of surveyed researchers said they were developing AI skills, while 68 percent had shifted toward more complex bugs.

The report combines platform data with surveys of 111 security leaders and 408 active researchers. Because year-over-year surveys used independent samples, the percentages should not be treated as a perfect longitudinal measure. The operational conclusion is clearer: faster discovery is useful only if validation, ownership and remediation scale with it.