September 2026 Summaries

Detectify’s Cyber Hygiene Index Report H2 2026 analyzes anonymized data from more than 1,290 organizations in the United States, United Kingdom, and Nordics, focusing on currently exposed external vulnerabilities rather than post-incident outcomes. It finds that most verified critical and high-severity vulnerabilities have remained open for over 90 days, affecting 97% in the Nordics, 92% in the UK, and 86% in the US, suggesting remediation delays are a greater challenge than detection. The UK had the strongest attack-surface monitoring but the lowest resolution rate, while the US had the largest and fastest-growing attack surface yet monitored only 29% of it. Sector results also varied: consumer brands had the largest backlogs but resolved severe issues fastest, public-sector organizations had the lowest resolution rate, and manufacturing performed consistently well where sufficient data was available. The report identifies exposed self-hosted AI platforms and AI-built applications as an emerging concern, associating them with remediation rates less than half those of the broader customer base, while noting that delayed fixes can sometimes reflect deliberate risk prioritization based on asset sensitivity or compensating controls.

Detectify announces its designation as a Major Player in the IDC MarketScape Worldwide DAST 2026 Vendor Assessment, presenting the recognition as evidence of a broader shift toward runtime security testing that verifies real-world exploitability rather than generating inferred alerts. The company argues that AI-assisted development increases the speed and volume of production code, making DAST an important safeguard for finding risks missed earlier in development. It contrasts legacy tools that identify potential vulnerabilities through version matching and fingerprinting with its approach of actively submitting payloads and reporting findings only when observable proof confirms exploitation. Detectify highlights three capabilities intended for enterprise AppSec programs: payload-verified vulnerability validation, its Alfred AI research agent and machine-learning fuzzer for developing detections against emerging threats, and Surface Monitoring for automatically discovering and adding external assets to scanning coverage. The company positions these features as a way to reduce false positives, lessen manual triage, maintain visibility across changing attack surfaces, and help developers address confirmed security issues more quickly.