The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Dark Reading reports that HackerOne CEO Kara Sprague said the number of critical vulnerabilities sitting in backlogs rose 30-fold over 12 months, even as mean time to remediation improved 50%. Those figures point to a possible mismatch between the pace of discovery and organizations’ capacity to clear unresolved issues—but the report does not provide the underlying dataset or definitions, so the scale and meaning of the comparison remain uncertain.
What the reported 30-fold increase means
The figure concerns critical vulnerabilities described as sitting in backlogs. It does not, on the information Dark Reading provides, establish whether the count includes untriaged reports, validated vulnerabilities awaiting a fix, or only issues confirmed as exploitable. Those categories represent different stages of security work and different levels of demonstrated risk.
As an Amazon Associate I earn from qualifying purchases.
Dark Reading attributes the 30-fold figure and the reported 50% improvement in mean time to remediation to Sprague. It does not give the baseline backlog, the duration used to calculate remediation time, the programs sampled, or the calculation method. The figures should therefore be read as a reported comparison, not as independently verifiable HackerOne-wide measurements. Dark Reading
How remediation time can improve while a backlog grows
A backlog is a stock: the number of issues still waiting at a given point. Mean time to remediation is a flow measure: the average time taken to resolve issues included in a particular measurement. They can move in opposite directions. For example, teams might close resolved issues faster while more findings arrive than they can process. Differences in the populations or time windows measured could also produce that pattern. These are possible explanations, not causes established by the report.
#1 Best Overall
Nor does a shorter mean establish that every issue is being handled faster. An average can conceal variation among severity levels, programs, or types of findings. A critical-vulnerability backlog could grow even if a broader remediation measure improves, depending on what each metric includes.
Discovery is only one part of reducing risk
In a March 2026 article, HackerOne describes how findings can accumulate when teams lack capacity to validate reports, route them to owners, remediate underlying causes, and verify fixes. Its point is that discovery alone does not ensure that risk has been reduced. A reported defect is not automatically a confirmed vulnerability, and a confirmed defect does not by itself demonstrate exploitability. HackerOne’s March 2026 article
That workflow offers useful context for understanding how a queue might grow, but it does not explain the specific 30-fold figure. The underlying report does not establish which stage of the workflow its backlog count represents.
Why other vulnerability figures are not direct comparisons
Other published metrics illustrate why scope matters, but they cannot verify or explain the reported backlog change:
- A 2024 peer-reviewed study using Bugcrowd data reports 1,021 paid vulnerabilities in 2019 and 1,136 in 2020. It found that increased submissions during the COVID period did not produce comparable growth in unique vulnerabilities discovered. This is historical data from a different platform, not a measurement of HackerOne’s later backlog. Journal of Cybersecurity study
- HackerOne’s 2025 reporting gives a 34-day median resolution lifecycle for penetration-test findings. That is a median for a specified finding population; it is not the mean remediation-time measure attributed to Sprague, nor a count of critical items waiting in a backlog. HackerOne’s 2025 reporting
What security teams should take from the report
The reported figures are a reason to examine how an organization moves findings from intake to verified closure, not proof that any one stage is failing. Useful operational checks include:
- Define backlog consistently: distinguish incoming reports, untriaged findings, validated vulnerabilities, and remediation-pending issues.
- Track counts by severity and workflow stage, alongside the dates and populations behind remediation-time measures.
- Measure throughput across validation, assignment, remediation, and verification—not only discovery or time to close.
- Confirm that fixes address the underlying issue and verify closure rather than treating a reported patch as completed work.
Before comparing a 30-fold backlog change with a remediation-time improvement, organizations would need the same population, clear metric definitions, and comparable baseline and end dates. The available Dark Reading account does not supply those details, so it cannot show how broadly the figures apply or why the measures moved differently.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
