--- title: 95% of Security Teams Blindsided by Vulnerabilities... description: New research from Synack reveals that 95% of enterprise security teams discovered high or critical vulnerabilities outside their scheduled testing windows in... canonical: https://daily.dev/posts/95-of-security-teams-blindsided-by-vulnerabilities-between-tests-zok2oizdf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 95% of Security Teams Blindsided by Vulnerabilities Between Tests | daily.dev og:description: New research from Synack reveals that 95% of enterprise security teams discovered high or critical vulnerabilities outside their scheduled testing windows in... og:url: https://daily.dev/posts/95-of-security-teams-blindsided-by-vulnerabilities-between-tests-zok2oizdf og:image: https://api.daily.dev/og/posts/Zok2OIZDf.png og:image:alt: 95% of Security Teams Blindsided by Vulnerabilities Between Tests og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 95% of Security Teams Blindsided by Vulnerabilities Between Tests **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 3 min read · 0 upvotes · 0 comments ## Summary New research from Synack reveals that 95% of enterprise security teams discovered high or critical vulnerabilities outside their scheduled testing windows in the past year, with 42% experiencing this at least monthly. The report identifies three core gaps: a coverage gap (38% of respondents left a quarter of their critical attack surface untested for 90+ days), an AI trust gap (79% won't act on AI findings without human validation), and a maturity gap (only 15% run continuous testing programs). While enterprises want AI to expand reconnaissance and coverage, human expertise remains essential for confirming exploitability, assessing business risk, and reducing false positives. Synack advocates for a combined Human + AI model using its Sara AI Pentesting and vetted researcher network to move organizations from periodic point-in-time testing toward continuous security validation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of enterprise security teams find critical vulnerabilities between scheduled pentest windows? 95% of enterprise security teams surveyed reported discovering high or critical vulnerabilities outside their scheduled testing windows within the past year, and 42% of those said it happened at least once a month. Separately, 38% reported that a quarter or more of their critical attack surface went untested for over 90 days, showing a persistent coverage gap between environment change and testing frequency. _Teams weighing continuous versus periodic pentesting can follow findings like these on daily.dev._ ### Are security teams willing to trust AI-generated vulnerability findings without human review? No, 79% of surveyed security practitioners said they would not act on an AI-generated finding without a human validating it first. Human expertise is still considered essential for confirming exploitability, assessing severity and business risk, testing complex workflows, reducing false positives, and communicating risk to stakeholders, even as AI is used to expand reconnaissance coverage. _Anyone deciding how much to trust AI in security workflows can track this debate on daily.dev._ ## Similar posts on daily.dev - [AI can find vulnerabilities. Humans find ways in](https://daily.dev/posts/ai-can-find-vulnerabilities-humans-find-ways-in-mi967qov8) · TechCentral · 0 upvotes · 0 comments - [AI Decline? Confidence Falls in Autonomous Penetration Testing](https://daily.dev/posts/ai-decline-confidence-falls-in-autonomous-penetration-testing-1pxtohmss) · Dark Reading · 1 upvotes · 0 comments - [Verify it, don’t assume it: why untested security controls are making life easy for attackers](https://daily.dev/posts/verify-it-don-t-assume-it-why-untested-security-controls-are-making-life-easy-for-attackers-5rputvafq) · IT Security Guru · 0 upvotes · 0 comments - [AI is turning offensive security into a continuous necessity](https://daily.dev/posts/ai-is-turning-offensive-security-into-a-continuous-necessity-dtkmtrav8) · CSO Online · 0 upvotes · 0 comments - [2026 State of Application Security Report Recap: What the Data Says and What Security Teams Should Do About It](https://daily.dev/posts/2026-state-of-application-security-report-recap-what-the-data-says-and-what-security-teams-should-d-yk5htpydo) · Orca Security Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/95-of-security-teams-blindsided-by-vulnerabilities-between-tests-zok2oizdf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"95% of Security Teams Blindsided by Vulnerabilities Between Tests","url":"https://daily.dev/posts/95-of-security-teams-blindsided-by-vulnerabilities-between-tests-zok2oizdf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/95-of-security-teams-blindsided-by-vulnerabilities-between-tests-zok2oizdf"},"datePublished":"2026-07-21T10:52:51.313Z","dateModified":"2026-09-13T18:40:41.454Z","description":"New research from Synack reveals that 95% of enterprise security teams discovered high or critical vulnerabilities outside their scheduled testing windows in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccd05cfc2e999dad37fa3d77b630af03?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccd05cfc2e999dad37fa3d77b630af03?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/95-of-security-teams-blindsided-by-vulnerabilities-between-tests-zok2oizdf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"95% of Security Teams Blindsided by Vulnerabilities Between Tests"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/95-of-security-teams-blindsided-by-vulnerabilities-between-tests-zok2oizdf#faq","mainEntity":[{"@type":"Question","name":"What percentage of enterprise security teams find critical vulnerabilities between scheduled pentest windows?","acceptedAnswer":{"@type":"Answer","text":"95% of enterprise security teams surveyed reported discovering high or critical vulnerabilities outside their scheduled testing windows within the past year, and 42% of those said it happened at least once a month. Separately, 38% reported that a quarter or more of their critical attack surface went untested for over 90 days, showing a persistent coverage gap between environment change and testing frequency. Teams weighing continuous versus periodic pentesting can follow findings like these on daily.dev."}},{"@type":"Question","name":"Are security teams willing to trust AI-generated vulnerability findings without human review?","acceptedAnswer":{"@type":"Answer","text":"No, 79% of surveyed security practitioners said they would not act on an AI-generated finding without a human validating it first. Human expertise is still considered essential for confirming exploitability, assessing severity and business risk, testing complex workflows, reducing false positives, and communicating risk to stakeholders, even as AI is used to expand reconnaissance coverage. Anyone deciding how much to trust AI in security workflows can track this debate on daily.dev."}}]} ```