Fluid Attacks’ 2026 Report Finds Rising Risk Exposure Across Tested Systems

Summary

Fluid Attacks’ report analyzes its 2025 security testing data, finding higher risk exposure across client systems, a large share of risk in high- and critical-severity flaws, and faster remediation among systems using its CI Gate.

Key points

• The report covers Fluid Attacks’ testing of client source code, applications, and infrastructure from January 1 to December 31, 2025.
• Fluid Attacks reported 1,119,396 vulnerabilities and 27.44 million CVSSF units of risk exposure; high- and critical-severity findings made up 4.5% of vulnerabilities but 79.9% of total exposure.
• Risk exposure per system rose year over year: the mean increased 8.5% and the median 33.5%. Seventy percent of assessed systems had at least one high- or critical-severity vulnerability, compared with 53.3% in 2024.
• Automated tools identified 55.8% of total risk exposure, while manual testing identified 87% of critical-severity vulnerabilities, according to the report.
• The overall remediation rate reached 62.2%. Systems using the CI Gate had a 72.2% rate, compared with 58% for systems that did not use it.
• Authentication-mechanism absence or evasion ranked highest by risk exposure, while lack of data validation was among the most widespread weaknesses, appearing in 64.5% of systems.

Vendors

Products

Tools