Cobalt LogotypeWhite

State of Pentesting
Report 2026

4.5x

How much more likely programmatic teams are to resolve critical findings in three days or less compared to ad-hoc or compliance-driven teams.

2.7x

The rate at which high-risk findings appear in AI/LLM tests compared to the overall dataset.

8 months

The additional window of risk exposure under-performers face compared to leaders.

sopr26-cover_tn

The definitive benchmark for offensive security and remediation performance

This report provides the actionable intelligence necessary to bridge the disconnect between executive perception and practitioner reality, offering a roadmap for teams to transform their offensive security from a reactive burden into a strategic advantage.

  • Leaders resolve risks 25x faster
  • AI risks outpace defensive reality
  • The programmatic advantage leads to better outcomes
Key Findings

The 25x remediation gap

A massive gap exists between leading organizations that integrate security and the laggard organizations that treat it as a periodic hurdle.

10 days: The half-life—how long vulnerabilities remain exploitable—of high-risk findings for top-performing teams.

249 days: The half-life—how long vulnerabilities remain exploitable—of high-risk findings for the bottom tier.

AI risks outpace defensive reality

Innovation is outstripping defense as organizations rush to deploy LLM-backed features without a matching security strategy.

32%: Percentage of all AI/LLM findings rated as High Risk.

38%: The resolution rate for AI vulnerabilities—the lowest of any category in our report.

Programmatic advantage graphic

The programmatic advantage leads to better outcomes

Strategic process maturity is the single greatest predictor of remediation success.

45% vs. 10%: Organizations that take a programmatic approach to security testing resolve 4.5x more critical findings in under three days than compliance-driven teams.

Webinar

How Elite Teams Outpace the Average Adversary

April 29 at 2:00 PM EDT | 30 April at 11:00 AM BST

Join our experts as they dissect the remediation divide to reveal how elite security teams neutralize high-risk findings and outpace machine-speed threats by reducing their total exposure window.

REGISTER FOR WEBINAR

Gunter Ollmann
CTO, Cobalt

Wade Baker
Co-Founder, Cyentia
Lorem Ipsum

Lorem Ipsum

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Phasellus imperdiet accumsan vehicula. Suspendisse dictum lorem ex, at laoreet ex fermentum eu. Nunc commodo ut magna a pellentesque.

FAQs
What is the State of Pentesting Report?

The 2026 State of Pentesting Report is an annual research publication by Cobalt that provides deep insights into the offensive security landscape. Now in its eighth year, the report combines data from thousands of real-world penetration tests with a qualitative survey of 450 security leaders and practitioners, to identify why vulnerabilities persist and how leading teams resolve them.

How does Cobalt collect data for the State of Pentesting Report?

The report draws from two primary datasets:

  • Pentest Data: Results from over 16,500 pentests conducted on nearly 3,000 organizations over a five-year period. This data is sanitized and analyzed by the Cyentia Institute.
  • Survey Data: A double-blind survey of 450 validated information security professionals (50% leaders, 50% practitioners) across various industries.
What are security Leaders and Laggards?

While multiple factors can be considered, this analysis is based on remediation of high-risk pentest findings—specifically the half-life of vulnerabilities (the number of days to remediate 50% of findings, including those that are still unfixed).

  • Leaders (Top 10%): Organizations that treat pentesting as a continuous program, achieving a high-risk finding half-life of just 10 days.
  • Laggards (Bottom 10%): Organizations that often view pentesting as a one-time compliance task, with high-risk vulnerabilities remaining open for a half-life of 249 days.
Does the State of Pentesting Report include security recommendations?

Yes, the State of Pentesting Report includes security recommendations based on best practices of top-performing organizations in the research. Key recommendations include:

  • Transitioning from ad hoc testing to a programmatic, continuous approach.
  • Aligning offensive security objectives with business strategy to gain board-level support.
  • Prioritizing remediation based on potential business impact rather than ease-of-fix.
sopr_banner-cover

Benchmark your defenses

against the top-performing organizations
Cobalt_homepage_cta_image@2x-1