Notifications
Clear all
Topic starter
18/08/2026 2:46 pm
TL;DR: Tech companies’ critical-vulnerability MTTR rose from 74 to 98 days in 2025, even as remediation improved at every other severity tier, according to Synack’s State of Vulnerabilities Report. The pattern points to distributed APIs, microservices, third-party integrations, and AI-generated code turning familiar weaknesses into cross-team coordination problems rather than simple patch tasks.
NHIMG editorial — based on content published by Synack: The Tech Sector’s Critical Vulnerability Paradox
By the numbers:
- The average time to remediate critical vulnerabilities in the tech sector grew from 74 days in 2024 to 98 days in 2025.
- The tech sector produced 197 critical-severity SQL injection instances in Synack’s 2025 data.
- The tech sector logged 103 medium-severity content injection instances in the same report.
Questions worth separating out
Q: What breaks when critical vulnerabilities span APIs, microservices, and third-party integrations?
A: Remediation slows because no single team owns the entire exposure path.
Q: Why do critical vulnerability fixes take longer in fast-moving tech environments?
A: Fast delivery creates change churn.
Q: How should security teams prove that a vulnerability has really been remediated?
A: They should require evidence that the vulnerable condition is no longer reachable or exploitable, not just that a ticket is closed.
Practitioner guidance
- Build cross-asset ownership maps for critical findings Assign each critical vulnerability to every affected service, data layer, and release owner before remediation begins.
- Move critical testing earlier in the development cycle Use continuous testing to find injection paths before code changes multiply and the fix requires coordinated releases across several teams.
- Treat AI prompt inputs as governed untrusted data Sanitise user uploads, scraped content, and external documents before they enter prompt contexts, and constrain model output before downstream systems consume it.
What's in the full article
Synack's full blog covers the operational detail this post intentionally leaves for the source:
- The report's sector-by-sector MTTR breakdown for critical, high, medium, and low findings.
- The underlying methodology behind the 11,000-vulnerability analysis across five industries.
- The remediation patterns the vendor attributes to distributed APIs, microservices, and AI-generated code.
- The continuous-testing model and how it is positioned to reduce coordination delay in live environments.
👉 Read Synack's analysis of why critical vulnerability remediation is slowing in tech →
Critical vulnerability MTTR in tech: what changed in 2025?
Explore further
18/08/2026 3:29 pm
Fragmented application ownership is now an access-control problem, not just a code-quality problem. When vulnerabilities span APIs, microservices, and third-party dependencies, the organisation no longer has one control owner or one remediation path. That creates the same governance failure identity teams see in sprawling service-account estates: the asset exists in many places, but accountability lives nowhere central. Practitioners should treat cross-asset visibility as a control objective, not a reporting nicety.
A question worth separating out:
Q: Who is accountable when an AI-assisted workflow is manipulated through untrusted content?
A: Accountability usually sits with both the application owner and the team governing the AI workflow, because the failure occurs at the boundary between data intake and model use. Organisations need clear ownership for sanitisation, output validation, and downstream consumption, or content injection will keep slipping between teams.
👉 Read our full editorial: Tech vulnerability remediation is slowing as attack surfaces fragment
