Security Report · raw.githubusercontent.com

Edgescan 2026 Report Highlights High-Risk Application Flaws and Remediation Backlogs

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

Edgescan’s 2026 report analyzes 2025 assessments across hundreds of organizations. High or critical flaws made up 31.9% of application/API findings, while large enterprises left an average of 37% of discovered vulnerabilities unresolved.

Key points

The report draws on thousands of penetration tests and continuous scans across millions of assets at hundreds of organizations globally during 2025.
Edgescan rated 31.9% of application/API findings high or critical; SQL injection accounted for 37.18% of high and critical public-facing application/API findings.
High and critical application/API vulnerabilities took an average of 54.8 days to remediate, compared with 39 days for device/network vulnerabilities.
High and critical vulnerabilities with EPSS scores above 0.7 took an average of 134.3 days to remediate, highlighting delays even for findings with high predicted exploitation likelihood.
Enterprises with more than 1,000 employees left an average of 37% of vulnerabilities discovered within a year unresolved; 19% of enterprise backlog findings were high or critical.
Among critical findings identified through penetration testing as a service, unauthenticated or weakly authenticated APIs accounted for 16%, followed by access restriction bypass at 14%.
The report recommends prioritizing remediation using exploit availability, exposure, and business impact alongside severity scores, with expert testing to address automation’s gaps in business logic and access controls.

Article Details

Publisher: Edgescan
Report Period: 2025
Scope: Global validated vulnerabilities across web applications, APIs, and network/host assets in public-facing and internal environments.
Sample Size: Thousands of security assessments and penetration tests on millions of assets across hundreds of organizations; exact counts not disclosed.
Key Statistics: Across web application and API layers, 31.9% of discovered vulnerabilities were High or Critical severity.
Approximately 6.2% of all vulnerabilities discovered in 2025 were linked to ransomware campaigns.
Average remediation time for High/Critical vulnerabilities was 54.8 days for applications/APIs and 39 days for devices/networks.
For enterprises with 1,000 or more employees, an average of 37% of vulnerabilities discovered within a 12-month period remained unremediated.
High or Critical severity vulnerabilities represented 19% of enterprise vulnerability backlogs.
Recommendations: Prioritize remediation using exploitability, exposure, business impact, exploit-code availability, and KEV status rather than relying on a single scoring system.
Complement automated scanning with manual reviews and expert analysis for complex business logic and multistep vulnerabilities.
Continuously discover and assess attack-surface exposures across public-facing and internal assets.
Prioritize injection prevention, secure file-handling controls, and replacement or upgrading of end-of-life components.
Strengthen internal resilience with validated backups, isolation plans, accelerated remediation of legacy vulnerabilities, and an assume-breach operational posture.