Topic starter
18/08/2026 2:46 pm
TL;DR: Tech companies’ critical-vulnerability MTTR rose from 74 to 98 days in 2025, even as remediation improved at every other severity tier, according to Synack’s State of Vulnerabilities Report. The pattern points to distributed APIs, microservices, third-party integrations, and AI-generated code turning familiar weaknesses into cross-team coordination problems rather than simple patch tasks.
Editorial analysis by NHI Mgmt Group, based on content published by Synack: “The Tech Sector’s Critical Vulnerability Paradox”.
By the numbers:
- The average time to remediate critical vulnerabilities in the tech sector grew from 74 days in 2024 to 98 days in 2025, representing a 32% slowdown.
- Tech companies produced 197 critical-severity SQL injection instances in Synack’s report.
- The tech sector logged 103 medium-severity content injection instances in the report.
Key questions
Q: What breaks when critical vulnerabilities are discovered in a fast-changing tech stack?
A: Remediation slows because the vulnerable code, the surrounding dependencies, and the responsible teams may all change before the fix is complete.
Q: Why do distributed APIs and microservices make SQL injection harder to remove?
A: They spread the same flaw across multiple ownership domains and data paths.
Q: What do security teams get wrong about content injection in AI-assisted workflows?
A: They often treat it as an AI output problem instead of an input-trust problem.
Practitioner guidance
- Implement continuous testing earlier in the delivery cycle Surface critical findings before multiple release changes make the fix a coordination exercise across teams and services.
- Correlate vulnerabilities to service ownership Track each finding to the exact API, microservice, data layer, or third-party integration that owns the risk so remediation is not handled as a generic ticket.
- Sanitise all prompt-bound external inputs Treat user uploads, scraped content, and external feeds as untrusted before they reach model context or AI-assisted workflows.
Bottom line: Critical remediation slowed in tech even while lower-severity issues improved, which points to coordination breakdowns rather than a general decline in security performance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:29 pm
Critical vulnerability remediation is now a coordination problem, not just a patching problem. The data shows tech can improve at high, medium, and low severity while still getting worse at critical fixes. That tells us the bottleneck is no longer simple triage, but ownership across services, dependencies, and delivery teams. The governance lesson is that vulnerability management must follow the asset graph, not the ticket queue.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
A: They should compare time to remediate against release churn, ownership changes, and the number of dependent services touched after discovery. If the fix regularly crosses team boundaries or waits for multiple change windows, the programme is lagging the pace of development. The metric should reflect operational complexity, not just closure counts.
👉 Read our full editorial: Tech vulnerability remediation is slowing as attack surfaces fragment