VULNpocalypse
InformationalVulnerabilityMonitoring

ProjectDiscovery says big firms shelve unverified vulnerability findings

Help Net Security reports ProjectDiscovery found nearly half of large firms close unverified findings; verify before you close them.

Published
Exploitation
No, this is a survey report and names no specific vulnerability; the exploitation-time figure is a Mandiant claim relayed by Help Net Security

What happened

According to Help Net Security, ProjectDiscovery found that nearly half of security teams at organizations with 5,000 or more employees close or deprioritize vulnerability findings without fully verifying them. Help Net Security says the reason respondents give is lack of time. This is a survey result reported by one outlet. It is not a breach or a newly disclosed flaw, and no specific vulnerability is named.

Help Net Security reports the following figures, attributed to the ProjectDiscovery survey unless noted:

  • Among teams that skip full verification, 57% say at least three out of four findings they do check turn out to be real.
  • Three in four teams say their backlog grew over the past year, and a big share of the new findings now comes from AI testing tools.
  • Most large enterprises have more than a thousand untriaged findings, and about a quarter have more than ten thousand.
  • Seven in ten teams pull findings from three or more sources, such as scanners, bug bounties, pentests and customer reports. Teams with five or more sources are nearly twice as likely as teams with one or two to close findings without fully verifying them.
  • More than half of security leaders agreed they do this, against about a third of practitioners.
  • Nearly nine in ten teams that cut this corner worry that real vulnerabilities are hiding in their backlog.

Help Net Security also relays a claim that Mandiant says attackers took an average of 7 days to exploit a vulnerability in 2025, compared with 63 in 2018. We have not checked the Mandiant data.

Not confirmed: the survey sample size, the methodology and the survey dates. We have not reviewed the original ProjectDiscovery report; everything here comes from the Help Net Security write-up.

Am I affected?

The sources do not describe a product, version or CVE, so there is nothing to match against an asset list. The finding is relevant to any organization that triages findings from several sources.

According to Help Net Security, teams that draw on more sources are more likely to close findings without full verification. The article reports backlog sizes separately and does not say that larger backlogs make this more likely. The sources do not say how many of the closed findings were actually exploitable, and they do not report any exploitation tied to this practice.

What to do now

  1. Check how your team closes findings. Find out whether a closure requires a verification step or only a time-based decision. The sources do not prescribe a fix; this step follows from the survey’s description of the problem.
  2. Count how many findings come from each source and whether one tool is treated as the only source of truth. Help Net Security says findings from the other sources can slip through without review when one tool is the reference.
  3. Treat the closure of unverified findings as a recorded risk decision rather than a default. Help Net Security reports that leaders and practitioners admit to the practice at different rates.
  4. Read the original ProjectDiscovery report if you want the methodology before using these figures internally. Its contents are not confirmed here.

Sources