HackerOne’s 10th annual Security Research Report found that the backlog of validated vulnerabilities awaiting resolution on its H1 Platform increased by 131% over two years, despite average remediation times improving by 54%. The report, Exposure Debt: The Next Challenge in Cybersecurity, says security teams are finding vulnerabilities faster than they can fix them.
AI is helping researchers identify issues such as authorisation flaws and multi-step attack chains that traditional scanners may miss. While organisations have reduced the average time to resolve findings, the volume of known, unresolved vulnerabilities continues to rise. HackerOne describes this accumulating risk as “Exposure Debt”.
AI vulnerability trends and exposure debt
Three-quarters of surveyed security leaders said their organisations formally track exposure debt, while nearly 70% said validated findings are arriving faster than teams can address them.
The report also points to changes in the types of AI vulnerabilities being reported. System Prompt Leakage reports rose 557% year on year, Misinformation reports increased 455%, and Improper Output Handling reports were up 264%. Prompt injection and sensitive information disclosure remained the largest categories of AI vulnerability reports on the platform.
“AI is changing both sides of the security equation. It’s helping researchers find vulnerabilities faster and go deeper, while representing entirely new attack surfaces for them to test,” said Kara Sprague, CEO of HackerOne. “At the same time, nearly 70% of security leaders say findings are piling up faster than their teams can address them. Fixing got faster. It still lost ground. The constraint is no longer discovery; it is everything between a report arriving and a risk being resolved.”
Bug bounty programmes and remediation
Meanwhile, 68% said they had shifted towards more complex bugs with higher bounties
Researchers are also adapting their working practices. According to the report, 85% of surveyed researchers are actively developing their AI skills, and nearly three-quarters said AI had meaningfully increased the number of valid findings they produce. Meanwhile, 68% said they had shifted towards more complex bugs with higher bounties.
Across HackerOne programmes, average resolution time fell from 135 days to 62 days over two years, a 54% improvement. Organisations using the H1 Platform awarded researchers a record $89 million between July 2025 and June 2026, up 18% on the previous year.
Researchers adapt to AI tools
“AI hasn’t replaced how I think as a security researcher. It’s changed how much ground I can cover,” said Douglas Day, a top-earning security researcher on HackerOne.
“I’ve automated parts of my research process that used to take hours, which gives me more time to focus on the vulnerabilities that require creativity, context, and an understanding of how systems actually work. The researchers who get the most out of AI won’t be the ones who simply turn it on. They’ll be the ones who know how to guide it, question it, and recognise when it has found something worth pursuing. The most valuable skill in the age of AI will be the ability to be flexible and adapt to new tools and technologies as they become available.”
HackerOne, a pioneer in Continuous Threat Exposure Management (CTEM), today released its 10th annual HackerOne Security Research Report, revealing that on the H1 Platform, the backlog of validated, unresolved vulnerabilities grew 131% in two years, even as average resolution time improved 54%. This year's report, Exposure Debt: The Next Challenge in Cybersecurity, introduces the urgent challenge security teams are grappling with in the race to stay ahead of attackers.
AI has changed what security researchers can find. In skilled hands, advanced models are surfacing authorisation flaws and multi-step attack chains that traditional scanners often miss. Organisations are responding: the average resolution time improved 54% this year, but discovery is outpacing remediation, and the gap between them continues to widen. Every vulnerability an organisation knows about and hasn't fixed is a risk it already owns and hasn't paid down. That's Exposure Debt, and it grew 131% in just two years.
Sensitive information disclosure
Key findings from the report include:
- Exposure Debt is compounding: Despite the fastest remediation speeds recorded on the H1 Platform, the backlog of known, unresolved findings has still grown 131% over the past two years.
- Security leaders are feeling the pressure: 75% of surveyed security leaders said their organisations formally track exposure debt, and nearly 70% confirmed that validated findings are entering their systems faster than their teams can fix them.
- AI vulnerabilities are shifting as systems become more connected: System Prompt Leakage reports increased 557% year over year, Misinformation rose 455%, and Improper Output Handling increased 264%. Prompt injection and sensitive information disclosure continue to account for the largest share of AI vulnerability reports on the platform.
Bug bounty programmes
“AI is changing both sides of the security equation. It’s helping researchers find vulnerabilities faster and go deeper, while representing entirely new attack surfaces for them to test,” said Kara Sprague, CEO of HackerOne. “At the same time, nearly 70% of security leaders say findings are piling up faster than their teams can address them. Fixing got faster. It still lost ground. The constraint is no longer discovery; it is everything between a report arriving and a risk being resolved.”
Additional notable findings from the report include:
- Researchers have incorporated AI into their workflows: 85% of surveyed researchers are actively upskilling in AI, with nearly three-quarters self-reporting a meaningful increase in valid findings.
- Complexity is the new frontier: 68% of surveyed researchers have shifted toward higher-complexity, higher-bounty bugs as AI changes how and where researchers spend their time.
- Remediation is faster than ever: Across HackerOne programmes, organisations have cut average resolution time from 135 days to 62 days, a 54% improvement in just two years.
- Researchers earned a record $89 million from July 2025 to June 2026: Organisations running bug bounty programmes on the H1 Platform awarded $89 million to security researchers, an 18% increase over the prior year and the highest annual total in the platform’s history.
Highest annual total
“AI hasn’t replaced how I think as a security researcher. It’s changed how much ground I can cover,” said Douglas Day, a top-earning security researcher on HackerOne.
“I’ve automated parts of my research process that used to take hours, which gives me more time to focus on the vulnerabilities that require creativity, context, and an understanding of how systems actually work. The researchers who get the most out of AI won’t be the ones who simply turn it on. They’ll be the ones who know how to guide it, question it, and recognise when it has found something worth pursuing. The most valuable skill in the age of AI will be the ability to be flexible and adapt to new tools and technologies as they become available.”
