Probably Not Exploitable

The assumption we've all made

If you've worked in security for any length of time, you've definitely turned to a colleague and said some version of "this probably isn't exploitable" and moved on. Usually late in the day, with a few dozen other findings waiting and a release going out in the morning.

But nobody says it because they don't care. They say it because there are only so many man hours in the week, and the queue keeps refilling. We wanted to know how common that assumption really is, and how people feel about the pile of work it creates.

So we decided to find out for ourselves. We went out and surveyed 214 security practitioners and leaders to learn more, and they were more candid than we expected.

44% told us they close or deprioritize findings without fully verifying them because they don't have time. Only 36% said that doesn't happen on their team. And the group most likely to admit it was CISOs and security leaders, at 54%.

That last number was surprising. This isn't something happening quietly behind leadership's back. It's the normal state of things, and the people running these programs & teams know it better than anyone.

Not panic. More like a low hum.

When we asked people how they feel about their backlog, the most common answer by far was "manageable, but always in the back of my mind." Nearly half (47%) picked it.

The worry underneath is real, though. 72% said they worry real vulnerabilities are sitting unnoticed in their backlog. What surprised us was who's worried. It isn't only the teams that are struggling.

In other words, feeling on top of things and feeling sure about what's in the queue are two different feelings. You can clear the pile and still not trust what came through it.

The pile isn't shrinking on its own, either. 74% said their backlog grew over the past year, and only 22% have hit zero in the last month. And the longer it's been since zero, the heavier that weight gets.

And most respondents don't think the fix is more people. Half (50%) agreed that hiring wouldn't solve their backlog problem. Only 23% disagreed. That tracks. You can't hire your way out of a queue that grows faster than anyone on the team can read it.

AI is part of the problem and part of the way out

Almost nobody thinks AI has left their backlog alone. Only 7% said it hasn't changed how they think about it, or that it's too early to tell. Everyone else has felt it somehow.

Some of that is volume. AI testing tools are now the most common source of findings in our sample: 78% get reports from AI tools or agents, more than from internal research (70%) or customer and third-party reports (54%). Nearly half say that's adding to the pile.

Some of it is the other side of the fence. 56% agreed that attackers using AI will find and exploit issues in their backlog before they get to them. That fear isn't abstract. The same tools that help defenders read findings faster help attackers work through known issues faster too.

Google's Threat Intelligence Group has seen this firsthand. It reported that North Korea's APT45 sent thousands of prompts to AI tools to analyze known CVEs and validate proof-of-concept exploits. Those are the same kind of known, disclosed issues that sit unverified in most backlogs.

And that's exactly why the old guess feels different now. "Probably not exploitable" was always a bet. When it took a person days or weeks to turn an obscure finding into a working exploit, the odds of losing that bet were lower. But now, that time is shrinking.

There's a hopeful side too. Teams that say AI is helping them triage faster feel noticeably better about their backlog: 14% of them describe it negatively, compared with 33% of everyone else.

So AI is adding to the pile and helping clear it at the same time. Which side wins mostly depends on whether it's pointed at the noise or just adding to it.

A lot of teams we talk to have started building their own AI triage with general-purpose tools. That's a good sign. It means people see the need. Where those setups usually fall short is the stuff around the model: memory of what you've already decided, context about your own environment, and the ability to see that a finding from one tool is the same issue another tool reported last week.

What would you do with the time?

Our favorite question in the survey was the last one: if your backlog hit zero tomorrow, what would your team do with that time?

A few people were realistic about it. One answer was simply "Wake up from my dream." Another started with "Never happen, but if it did..."

Most answers, though, pointed in the same direction. Threat hunting. Security architecture. Paying down technical debt. Automation. Training and upskilling. One person said they'd "try to keep it at zero for a longer period," which might be the most honest goal in the whole dataset.

That's the part that resonates with us. Security teams aren't short on ideas for better work. They're short on time, and the backlog gobbles it up.

None of this is about anyone doing their job badly. It's about a queue that grew faster than any team could read it, and a guess that used to be safer than it is now. The good news is that the same technology making the problem worse can help with it, if it's built to verify what's real and not just add more to the pile.

We pulled all of this, plus more on where findings come from and how size changes the picture, into a full report.