HackerOne finds backlogs up 131%

The backlog is now the story

HackerOne’s new vulnerability data puts a hard number on a problem many security teams already feel every week: the backlog of validated, unresolved vulnerabilities on the H1 Platform grew 131% over two years [1]. The figure is striking because it does not describe noisy scanner output or speculative risk. It refers to findings that have been validated, accepted into a workflow and left waiting for resolution.

That makes the story less about whether organizations can find weaknesses and more about whether they can finish the work after a weakness is confirmed. HackerOne’s report says average resolution time fell from 135 days to 62 days over the same period, a 54% improvement [1]. On its face, that sounds like a remediation success story. In practice, it reveals a more uncomfortable equation: even when teams fix faster, the volume of incoming valid findings can still overwhelm the system.

HackerOne calls the gap “Exposure Debt,” meaning the accumulation of validated vulnerabilities that an organization knows about but has not yet resolved [1]. The term matters because it changes the mental model. A backlog is often treated as an operational queue. Debt implies interest, compounding risk and a cost that grows the longer the liability remains open.

Faster fixes, but a wider gap

The central paradox is that remediation speed improved while exposure grew. HackerOne’s benchmark explains that valid vulnerability reports awaiting resolution rose 131% between 2024 and 2026, even though resolved reports moved through the system more than twice as fast [2]. The practical explanation is simple: discovery has accelerated faster than the downstream ability to validate, assign, patch, test and deploy fixes.

Nearly 70% of surveyed security leaders said findings are arriving faster than their teams can remediate them, while 75% said their organizations formally track exposure debt [1]. That combination suggests the issue is not invisible. Many organizations know the backlog exists, measure it and still cannot reduce it.

The problem is also not evenly distributed. HackerOne’s benchmark says organizations with more than $10 billion in revenue averaged 84.2 valid reports in 2026, compared with 14.5 for organizations with $1 million to $5 million in revenue [2]. Larger enterprises have broader application estates, more APIs, more cloud services, more third-party dependencies and more ownership boundaries. A confirmed bug can travel through several teams before it reaches the engineers who can actually fix it.

That routing delay is where the backlog monster finds its infinite inventory slots. The vulnerability is no longer unknown. It is simply unclosed.

AI is increasing the inflow

AI is a major part of the current explanation, but not in a simplistic “AI causes more bugs” sense. HackerOne’s reporting says AI-assisted vulnerability research is helping researchers automate reconnaissance and report-writing tasks, freeing them to spend more time on complex issues such as authorization flaws and multi-step attack chains [1]. In other words, AI is expanding researcher reach.

HackerOne found that 85% of surveyed researchers are developing AI skills, nearly three-quarters said AI has meaningfully increased their valid findings, and 68% said they have shifted toward more complex vulnerabilities with higher bounty awards [1]. That is good news for discovery quality, but it increases pressure on the remediation side.

The AI-specific vulnerability mix is also changing. Cybersecurity Insiders’ coverage of the HackerOne findings reported that system prompt leakage reports increased 557% year over year, misinformation reports rose 455%, and improper output handling increased 264% [1]. Prompt injection and sensitive information disclosure remained the two most commonly reported AI vulnerability categories on the platform [1].

That means security teams face two overlapping queues: the traditional backlog of application, cloud and API weaknesses, and a newer set of AI-system findings tied to prompts, outputs, data flows and tool-connected agents. Both require engineering changes, not just security triage.

Why “mean time to remediate” is not enough

The fall from 135 days to 62 days is still important [1]. It shows that many programs have improved intake, routing and closure. But the backlog growth shows why a single average can be misleading.

An average remediation metric counts what got fixed. It does not fully describe what remains open. If easy or well-owned issues close quickly while complex, cross-team or architectural defects sit untouched, the average can improve while real exposure accumulates. HackerOne’s benchmark makes that point directly: the 62-day figure counts reports that reached resolution, while harder findings may be left waiting [2].

For executives, that means the better dashboard is not just “How fast do we close?” It is also “What is still open, how severe is it, how old is it, who owns it and what systems does it affect?” Exposure debt should be tracked by severity, age, exploitability, business criticality and ownership.

The same logic applies to vendors selling software into enterprises. A vendor with a large validated backlog is not merely carrying internal technical debt; it is transferring risk anxiety to buyers. Enterprise customers increasingly want evidence that vulnerabilities are not only found but fixed within predictable service-level targets.

The ownership bottleneck

HackerOne’s findings point to a remediation bottleneck that sits between security and engineering. Security teams can validate and prioritize, but they often cannot patch production code themselves. Engineering teams can patch, but they are measured on feature delivery, reliability and product deadlines as well as security.

That mismatch creates a familiar loop. Security opens an issue. Engineering asks for reproduction details, severity context or product impact. The issue waits. A sprint fills. A service owner changes. A dependency has no easy upgrade path. A patch risks breaking a customer workflow. The finding remains valid, unresolved and available to attackers who do not care which internal team owns the fix.

HackerOne’s current messaging continues to frame the industry’s challenge as a shift from finding more to fixing faster, with the company noting in recent updates that exposure debt is up 131% since 2024 while teams are remediating 54% faster [3]. The implication is that efficiency gains alone are not enough. Organizations need more remediation capacity, clearer accountability and better risk-based sequencing.

What buyers and CISOs should ask now

The first question is whether validated vulnerabilities have explicit owners. A queue without owners is not a remediation program; it is a waiting room. Each accepted finding should map to a system owner, a fix owner and an escalation path.

The second question is whether service-level targets differ by risk. Critical exploitable findings should not compete on equal terms with low-impact hygiene issues. HackerOne’s benchmark emphasizes the need to know which exposures are genuinely exploitable and where limited resources should focus [2].

The third question is whether AI-assisted discovery is being matched by AI-assisted remediation carefully enough. AI can help summarize findings, generate test cases, suggest patches and identify duplicate bug classes. But the final accountability for correctness still belongs to humans and organizations, especially when a fix changes production behavior.

The fourth question is whether the backlog is shrinking in the categories that matter most. Total backlog size matters, but so does the age of critical and high-severity findings. A program can tolerate some low-risk deferrals; it cannot safely normalize aging exploitable weaknesses in business-critical systems.

The bottom line

HackerOne’s 131% backlog increase is not a claim that security teams are lazy or that vulnerability disclosure has failed. It shows the opposite: disclosure, bounty programs and AI-assisted research are producing more validated signal than many organizations can absorb [1]. The system is discovering risk faster than it can retire risk.

That should push boards and CISOs away from vanity metrics based only on discovery volume. A bigger funnel of valid findings is valuable only if the organization can convert it into verified fixes. Otherwise, every new confirmed vulnerability becomes another item in the backlog monster’s inventory.

The current lesson is blunt: modern security programs do not just need better eyes. They need stronger hands, clearer ownership and enough engineering time to close what those eyes now see.

Sources from the last 72 hours

1. [1]HackerOne Report Finds Vulnerability Backlogs Grew 131% in Two YearsOct 17, 2026, 2:00 AM
2. [2]The Exposure Debt Benchmark: What the 2026 Data Says About the Find-to-Fix GapOct 14, 2026, 9:35 PM
3. [3]HackerOne | LinkedInOct 16, 2026, 12:00 PM

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.