A surge in AI-driven cyberattacks is widening the gap between vulnerability detection and effective remediation, with critical exposures doubling over the past year, according to new research from Check Point Software Technologies.
The company’s 2026 Exposure Gap Report, released in Paris, finds that vulnerabilities now account for 42.6% of all critical exposures, up sharply from 18.7% a year earlier. Despite this increase, fewer than one in 12 vulnerability alerts—just 7.8%—require urgent action after validation, highlighting a growing challenge for security teams overwhelmed by alert volumes.
The findings point to a fundamental shift in cybersecurity priorities. As automated attack tools enable threat actors to probe systems at scale and speed, the report argues that the key differentiator is no longer detection capability but the ability to identify which exposures are genuinely exploitable.
“Attackers are now testing more exposures, across more organisations, at greater speed than security professionals can manually keep pace with,” said Yochai Corem, vice president and general manager of exposure management at Check Point. “The organisations that stay ahead are those that can separate real risks from noise and remediate them safely.”
The report highlights a growing “exposure gap”—the disconnect between visibility, prioritisation and remediation—exacerbated by AI-assisted attacks that compress response windows. While organisations are identifying more vulnerabilities, many lack the capacity to triage and act on them effectively.
Risk is also becoming increasingly concentrated. Vulnerabilities and internal information disclosure together account for 76% of all critical exposures, underscoring the importance of addressing exploitable weaknesses and data exposure risks. Meanwhile, phishing is emerging as a rapidly expanding threat vector, rising to 10.5% of critical exposures from just 1% a year earlier.
Despite these challenges, the data suggests that effective remediation at scale is achievable. Organisations acted on 85.9% of recommended fixes across industries, and some sectors demonstrated rapid response capabilities. Utilities, for example, resolved 30% of critical exposures within one hour, while the fastest sector recorded a median remediation time of 12.6 hours.
However, performance varies significantly by industry. Utilities and government sectors reported the highest concentration of vulnerabilities, accounting for 78.2% and 56.4% of critical exposures respectively. In contrast, internal information disclosure was the dominant risk in healthcare and financial services.
Healthcare organisations faced the greatest remediation challenges, with a median response time of 158.8 hours, reflecting operational constraints such as legacy infrastructure and strict uptime requirements.
Check Point said its exposure management approach integrates discovery, prioritisation and remediation into a single workflow, enabling organisations to focus on the most critical risks before they are exploited.
The report underscores a broader industry shift towards prioritisation-driven security strategies, as enterprises seek to manage rising complexity and accelerate response in an AI-driven threat landscape.
