Nine in ten open critical and high-severity vulnerabilities have remained exposed for more than 90 days across organisations analysed in the H2 2026 Cyber Hygiene Index from Detectify.
According to Detectify, the problem was consistent across every market: 97% of open critical and high-severity vulnerabilities in the Nordics, 92% in the UK and 86% in the US had remained exposed for more than three months.
Cyber-hygiene, as this index defines it, measures whether organisations know what’s exposed on their attack surface and how quickly they act on it.
On top of the challenge posed by unresolved exposure, Shadow AI is emerging as a new frontier in cyber-hygiene, as organisations adopt AI tools and applications that may not be fully visible or controlled by security teams.
Detectify is increasingly identifying publicly exposed instances of self-hosted AI platforms and AI-built applications, such as Open WebUI, Lovable, LibreChat or Base44, across its customer base.
Organisations with exposed AI tooling tend to resolve critical and high-severity vulnerabilities at less than half the rate of the broader customer base, said Detectify.
Shadow AI is emerging as an additional challenge alongside the broader issue of unresolved exposure.
As AI use expands and attack surfaces evolve, maintaining cyber-hygiene will increasingly mean knowing what AI assets are exposed and maintaining control over them.
“Open without an incident”
Rickard Carlsson, CEO and Co-Founder of Detectify commented: “A critical vulnerability does not become less dangerous because it has been sitting there for 90 days.
“But organisationally, that is often what happens – the longer a known issue remains open without an incident, the easier it becomes to treat it as normal.
“That is the risk in a stale backlog.
“Exposure can effectively become accepted without anyone ever making a conscious decision to accept it.
“The absence of an incident starts to feel like evidence that the risk is tolerable, even though nothing about the vulnerability itself has changed,” Carlsson concluded.
Challenges
Detectify highlighted that its data points to a mounting challenge for security teams.
Exploit-verified known critical risks already remain unresolved for months, even as AI further accelerates the pace of software development and cyber-threat activity.
Meanwhile, the zero-day clock keeps ticking down, with the exploit window shrinking toward zero.
As these specific assessments test real-world exploitability through 100% payload-based methodology, organisations know these backlog vulnerabilities are verified risks.
However, a delayed fix does not always signal inaction; a technically critical vulnerability on a low-sensitivity asset or behind compensating controls may reflect a calculated business decision to deprioritise risk based on internal context.
UK gap
According to the company, the UK offers the clearest example of the gap: organisations monitor 72% of verified domains, more than double the rate in the Nordics (32%) and US (29%), yet record the lowest critical and high-severity vulnerability resolution rate of the three markets.
Among organisations using Detectify for at least 12 months, verified domains grew about 20% year over year in the US, 14% in the UK and 3.4% in the Nordics over the past year.
The sector data points to a similar pattern.
Consumer packaged goods and brands carried large vulnerability backlogs, yet they resolved critical and high-severity vulnerabilities at the highest rate of any sector, at 46%.
Public-sector organisations sat at the opposite end, resolving 8%, less than one-fifth the rate of consumer brands.
“Reduce that translation step”
Danwei Tran Luciani, Chief Product Officer at Detectify commented: “When a team is staring at thousands of open findings, the challenge is not always identifying which ones are critical.
“It’s whether the finding arrives with enough context for an engineer to act.
“Can the asset be reached? Is the vulnerability realistically exploitable? And who’s responsible for fixing it?
“The fastest-moving teams reduce that translation step.
“The more context that travels with the finding, the less time teams spend re-investigating the problem before they can fix it,” he concluded.
Discovery and remediation
According to the company, the findings point to three ways organisations can shorten the distance between discovery and remediation:
- Continuously discovering new internet-facing assets
- Giving critical findings enough context around exposure and ownership for engineers
- Act quickly and verifying that fixes have actually removed the risk
Increasingly, parts of that loop – including prioritisation, re-testing and verification – can be automated, allowing security teams to keep pace as attack surfaces keep growing and agentic software development accelerates.