Organizations Fix Less Than Half of All Exploitable Vulnerabilities, With Just 21% of GenAI App Flaws Resolved

Cobalt's State of Pentesting Report 2025 finds organizations remediate under half of pentest findings (48%) and only 21% of serious vulnerabilities in genAI/LLM web apps, highlighting widespread remediation gaps, overconfidence among security leaders, and top concerns including prompt injection, model manipulation, and data leakage while noting pressure to prioritize speed over security.