Organisations are fixing less than half of all exploitable vulnerabilities, with just 21% of genAI app flaws being resolved, penetration testing firm Cobalt found.

The company’s State of Pentesting Report 2025 found crucial discrepancies between how ‘safe’ security leaders believe their organisations are versus the reality, based on their analysis of pentests carried out by Cobalt.

The Report aims to explore the landscape of vulnerabilities organizations battle today and identifies how security leaders’ understanding of their security posture can be contradicted by the number of unremediated threats in their organization.

Cobalt found that most firms are over-confident in their security posture, with 81% of security leaders ‘confident’ in their firm, despite 31% of the serious findings discovered having not been resolved.

Overall, firms are remediating just 48% of all pentest results, however, this number significantly improves (69%) for findings labelled serious (vulnerabilities rated high and critical severity).

Organisations are particularly struggling with vulnerabilities within their genAI LLM web apps. Most (95%) firms have performed pentesting on these apps in the last year with a third (32%) of tests finding vulnerabilities warranting a serious rating.

Of those findings, a mere 21% of vulnerabilities were fixed, with risks including prompt injection, model manipulation, and data leakage.

About three quarters (72%) ranked AI attacks as their number one concern – ahead of risks associated with third-party software, exploited vulnerabilities, insider threats, and nation state actors.

Recommended reading

• What Potential Snags do Firms Face to Meet DORA Requirements?
• Commercial Codebases Leave Gaping Vulnerabilities
• High Risk Sectors Have the Most Critical Vulnerabilities

Only 64% say they are ‘well equipped to address all security implications of genAI.”

Further, more than half of security leaders (52%) say they are getting pressure to support speed at the cost of security.

This is despite just half (50%) of leaders fully trusting that they can identify and prevent a vulnerability from their software suppliers – a particular concern given that 82% are required by customers/regulators to provide software security assurance.

“Regular pentesting has never been so important, particularly given the breakneck speed of AI adoption and the vulnerabilities that are introduced into an organization’s security posture,” said Gunter Ollman, CTO, Cobalt.

“It’s a concern that 31% of serious vulnerabilities are not being fixed, however at least these firms are aware of the problem and can develop strategies to mitigate the risk.

“Organizations that do take an offensive security approach are taking a huge step to strengthening defenses against cybercriminals who typically attack opportunistically. In doing so they’re getting ahead of any compliance requirements and reassuring their customers that they’re safe to do business with.”