[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBdQhZx9cK6eG_Kwv3fp6SjvGkdpHjPzAI4RAR6VXxbM":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"6d9174cd-003f-4ed0-870a-d7a004a04413","Nearly half of big firms shelve or close vulnerability findings they haven’t confirmed","nearly-half-of-big-firms-shelve-or-close-vulnerability-findings-they-haven-t-con-6d8ff4","Nearly half of security teams at organizations with 5,000 or more employees close or deprioritize vulnerability findings without fully verifying them, ProjectDiscovery found, and the reason they give is time. Here’s the catch. Among teams that skip full verification, 57% say at least three out of four findings they do check turn out to be real. If most of what you look at is genuine, there’s not much reason to think the stuff you didn’t … More → The post Nearly half of big firms shelve or close vulnerability findings they haven’t confirmed appeared first on Help Net Security.","A ProjectDiscovery report reveals that nearly half of security teams in large organizations (5,000+ employees) close or deprioritize vulnerability findings without full verification, citing time constraints. Despite this, 57% of these teams find that most of the findings they do check are legitimate. The backlog of vulnerabilities is growing, with many large enterprises having over a thousand untriaged findings, and AI testing tools are contributing to this increase.","Nearly half of large firms close vulnerability findings without full verification due to time constraints.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F11\u002Fsecurity-teams-vulnerability-backlog\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002F05123940\u002Fbroken.webp","2026-11-11T05:30:30+00:00","2026-11-11T06:00:25.356545+00:00",7,[17,20],{"name":18,"type":19},"ProjectDiscovery","vendor",{"name":21,"type":19},"Mandiant","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":22,"icon":24,"name":25,"slug":26},null,"Vulnerabilities","vulnerabilities",[28,33,35],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":34},{"id":22,"icon":24,"name":25,"slug":26},{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":43,"vendors":128},[44,73,99],{"slug":45,"name":46,"problem":47,"products":48},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":74,"name":75,"problem":76,"products":77},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-flex","AttackIQ Flex","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fflex\u002F","Agentless, on-demand testing of security controls without deploying the full platform.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"cymulate","Cymulate","\u002Fvendor-logos\u002Fcymulate.png","cymulate-exposure-validation","Cymulate Exposure Validation","https:\u002F\u002Fcymulate.com\u002Fexposure-validation\u002F","Tests security controls, cloud defences and response playbooks against real threats to show which exposures are exploitable.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":95,"product_name":96,"url":97,"description":98},"attackiq-ready","AttackIQ Ready","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fready\u002F","Managed service that runs MITRE ATT&CK based emulations for you, with no scripting or tuning on your side.",{"slug":100,"name":101,"problem":102,"products":103},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"intezer","Intezer","\u002Fvendor-logos\u002Fintezer.png","intezer-ai-soc","Intezer AI SOC","https:\u002F\u002Fintezer.com\u002Fproduct\u002Fai-soc","Investigates every alert at forensic depth, escalates the small share that need a person, and feeds each verdict back into detection engineering.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"7ai","7AI","\u002Fvendor-logos\u002F7ai.png","7ai-agentic-security-platform","7AI Agentic Security Platform","https:\u002F\u002F7ai.com\u002Fplatform","AI agents for alert triage, investigation and threat hunting in one platform for the SOC.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":139},"half-of-large-enterprises-archive-unverified-vulnerabilities-leaving-real-risks-unaddressed","Half of Large Enterprises Archive Unverified Vulnerabilities, Leaving Real Risks Unaddressed","Nearly half of security teams at large organizations are closing or deprioritizing vulnerability findings before fully verifying them, primarily due to time pressure and backlog volume. This is dangerous because 57% of findings that teams do investigate turn out to be legitimate threats — meaning shelved findings likely contain real, exploitable vulnerabilities. The growing use of AI-powered testing tools is accelerating the volume of findings faster than teams can process them, widening the gap between discovery and remediation. Ignoring unverified vulnerabilities is essentially accepting unknown risk, leaving organizations exposed to breaches that could have been prevented with proper triage processes.",[134,135,136,137,138],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF 2.0 ID.RA-1: Asset vulnerabilities are identified and documented","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":140,"CIS Control 7: Continuous Vulnerability Management (v8)":141,"NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning":142,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":143,"NIST CSF 2.0 ID.RA-1: Asset vulnerabilities are identified and documented":144},"NIS2 Article 21(2)(e) explicitly requires vulnerability handling and disclosure practices, meaning organizations cannot legitimately close vulnerabilities without a verified, documented rationale.","CIS Control 7 requires organizations to establish a continuous process for identifying, triaging, and remediating vulnerabilities — directly addressing the failure to verify and act on findings before closing them.","RA-5 requires organizations not only to scan for vulnerabilities but to analyze and remediate findings, which is undermined when findings are closed without confirmation of their validity.","This control requires timely identification, evaluation, and remediation of technical vulnerabilities, which is directly violated when unverified findings are deprioritized or discarded due to resource constraints.","This category requires that identified vulnerabilities be properly documented and assessed, a process that is bypassed when teams archive findings without verification."]