The verification gap
How often teams close findings without verifying them, and why leaders already know it's happening.
Probably Not Exploitable:
The 2026 Vulnerability Backlog Report
Nearly half of enterprise security teams close vulnerability findings without fully verifying them. And not because of carelessness; there are simply more findings than hours in the day.
Now AI is enabling attackers to work through known vulnerabilities faster than ever, which raises the stakes on every finding that goes unchecked. 72% of security teams worry something real is hiding in their backlog.
We surveyed over 200 security leaders and practitioners to find out how teams are handling the gap between findings and verification, and what changes if the backlog ever hits zero.
This report reveals:
How many teams close findings without verifying them, and what the findings they do check turn out to be
Why more scanners lead to less verification, not more
How AI is adding to the backlog while helping teams clear it at the same time
Read the Report
What You'll Learn
Learn how security teams really feel about their vulnerability backlogs, why the cost of an unverified finding has gone up, and what separates teams that reach zero from teams that never do.
Where the backlog comes from
Why teams with five or more finding sources are nearly twice as likely to skip verification.
AI on both sides
How AI changed the cost of a wrong call, and how it's helping teams keep up.
The case for zero
Why teams that recently cleared their backlog feel so differently from teams that never have.
report quote
It's not even possible [to triage] with how many are sitting there.
— CISO, survey respondent
The question isn't whether your backlog has noise. It's whether you can tell what's real before someone else does.
What's lurking in your backlog?
Download the report to see how 200+ security teams are handling the gap between findings and verification, and what it takes to get to zero.