Under Pressure: report on the 2026 gap revelations

Check Point Software Technologies Ltd., a provider of cybersecurity solutions, today published its new annual studyUnder Pressure: The 2026 Exposure Gap Report", according to which the percentage of critical risk reports related to vulnerabilities has more than doubled in a year. At the same time, the research finds that less than one in twelve vulnerability notifications ultimately require immediate intervention, highlighting the need for more effective risk prioritization.

Automation and AI-powered attack tools are fundamentally changing the scale and speed at which cybercriminals operate. Attackers can now identify and test exposed systems, credentials, phishing infrastructure, and known vulnerabilities at a much greater scale and speed than traditional security team assessment processes can handle.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

As a result, the so-called “Exposure Gap” widens, i.e. the gap between visibility, prioritization and safe remediation of risks, while at the same time limiting the time organizations have to act before a risk turns into a real operational threat.

The main findings of the report

• Vulnerabilities recorded a significant increase: 42,6% of all critical risk reports were related to vulnerabilities, up from 18,7% the previous year, making them the most significant category of critical risks for 2026.
• The problem of prioritization remains acute: Only 7,8% of vulnerability notifications were rated High or Critical after being reviewed for actual exploitability. In other words, more than 90% did not require immediate remediation.
• The risks are concentrated in two main categories: 76% of critical reports come from vulnerabilities and insider information leaks.
• The Phishing continues to increase: Phishing websites accounted for 10,5% of critical risk reports in 2026, up from just 1% the previous year, recording one of the largest increases among all threat categories.
• Organizations can respond effectively when the right strategy is in place: 85,9% of the proposed corrective actions were implemented in the sectors analyzed, demonstrating that effective prioritization and appropriate procedures allow risks to be addressed on a large scale.

“Attackers are now testing more exposure points, across more organizations, and at a pace that cybersecurity professionals are struggling to keep up with manually. The organizations that stay one step ahead are those that can quickly distinguish truly exploitable risks from the ‘noise’ of thousands of alerts and address them without impacting their operations. That’s exactly what Exposure Management delivers, and that’s why it’s evolving into a key indicator of operational readiness,” said Yochai Corem, VP and General Manager of Exposure Management at Check Point Software Technologies.

The report also demonstrates that rapid and secure recovery is possible. A significant percentage of organizations were able to resolve critical issues within the first hour of their discovery, while the fastest industry recorded a median recovery time of just 12,6 hours.

At the same time, there are significant differences between sectors. Vulnerabilities are prevalent in Utilities and the Public Sector, while insider trading is the main source of risk in the Healthcare and Financial Services sectors. The Healthcare sector records the highest recovery time, mainly due to the use of older systems, the need to ensure uninterrupted operation of critical services and strict change processes.

Check Point Exposure Management unifies risk identification, evidence-based prioritization, exploitability assessment, audit of existing security measures, and secure remediation into a single process, helping organizations effectively bridge the gap between identifying and addressing cyber risks.

The report was presented at Check Point Engage Paris 2026 , and is available for download on the company's website.

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.