Detectify Cyber Hygiene Index Report reveals that most critical vulnerabilities sit unfixed for months

Detectify’s Cyber Hygiene Index Report H2 2026 analyzes anonymized data from more than 1,290 organizations in the United States, United Kingdom, and Nordics, focusing on currently exposed external vulnerabilities rather than post-incident outcomes. It finds that most verified critical and high-severity vulnerabilities have remained open for over 90 days, affecting 97% in the Nordics, 92% in the UK, and 86% in the US, suggesting remediation delays are a greater challenge than detection. The UK had the strongest attack-surface monitoring but the lowest resolution rate, while the US had the largest and fastest-growing attack surface yet monitored only 29% of it. Sector results also varied: consumer brands had the largest backlogs but resolved severe issues fastest, public-sector organizations had the lowest resolution rate, and manufacturing performed consistently well where sufficient data was available. The report identifies exposed self-hosted AI platforms and AI-built applications as an emerging concern, associating them with remediation rates less than half those of the broader customer base, while noting that delayed fixes can sometimes reflect deliberate risk prioritization based on asset sensitivity or compensating controls.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.