Cobalt Pentesting Report Finds Wide Remediation Gaps and Elevated AI Security Risks

Summary

Cobalt’s 2026 pentesting report finds high-risk remediation half-lives ranging from 10 to 249 days. AI/LLM findings were rated high risk nearly 2.7 times as often as findings overall, while only 38% of high-risk AI findings were resolved.

Key points

The study analyzes over 16,500 pentests across nearly 3,000 organizations over five years, independently analyzed by Cyentia Institute, alongside a survey of 450 security leaders and practitioners.
High-risk finding half-life—the time to resolve half of findings, accounting for unresolved issues—was 10 days for top performers, 45 days at the median, and 249 days for bottom performers.
AI/LLM tests classified 32% of findings as high risk, compared with 12% overall. Their high-risk resolution rate improved from 21% to approximately 38%, still the lowest testing category.
Prompt injection accounted for 37.6% of AI/LLM findings. Among survey respondents reporting AI-related incidents, shadow AI was the most commonly cited cause, at 44%.
Median organizational mean time to resolution for high-risk findings was 39 days. Consistent SLA compliance was reported by 57% of executives but only 15% of practitioners.
Resolution statistics depend on customer reporting: findings without evidence of resolution can remain classified as unresolved, so actual fix rates may be higher.
The report recommends continuous testing, clear remediation ownership, integration with development workflows, business-impact prioritization, and specialized testing of AI implementations.

Article Details

Publisher: Cobalt
Report Period: 2021–2025 pentest data
Scope: Cross-industry pentest findings, remediation performance, offensive security practices, and AI/LLM application security.
Sample Size: Over 16,500 pentests across nearly 3,000 organizations over five years; 450 validated survey responses, equally split between information security leaders and practitioners.
Key Statistics: Organization-level high-risk finding half-life was 10 days for the top 10%, 45 days at the median, and 249 days for the bottom 10%. Half-life incorporates unresolved findings through survival analysis.
High-risk findings represented 32% of AI/LLM pentest findings versus approximately 12% across all pentest types, nearly a 2.7-fold difference.
The resolution rate for high-risk AI/LLM findings was 38.4%, the lowest of any pentest category; the report describes an increase from approximately 21% the previous year.
The median organization resolved 86% of its high-risk findings. Findings without recorded resolution evidence were counted as unresolved, so actual remediation may be higher.
57% of surveyed cybersecurity leaders said their organizations consistently met or exceeded remediation SLAs, compared with 15% of practitioners.
Recommendations: Replace ad hoc or compliance-only pentesting with continuous, programmatic testing.
Assign clear ownership of findings, integrate remediation into development and IT workflows, enforce agreed SLAs, and maintain findings as a live risk register.
Prioritize remediation by potential business impact and exposure of PII or sensitive data.
Require penetration test reports for purchased software and tools before deployment.
Proactively test and monitor AI/LLM implementations using pentesters with specialized LLM expertise.