Pentest remediation statistics: time to fix and resolution rates

Pentest remediation statistics show how long teams take to fix findings and how many they fix at all. Last updated: 9 November 2026. Every number here comes from Cobalt, a company that sells pentests, so treat all of it as vendor data.

Key figures#

Two Cobalt editions give different answers because they measure different things. Read them side by side, and do not mix their numbers.

Sources#

The 2025 edition rests on over 16,000 pentests on more than 2,700 organizations over 10 years. Cyentia Institute analyzed the platform data independently. The survey part has 450 validated responses from an Emerald Research double-blind survey, split 50% security leaders and 50% practitioners (research methodology, p.31).

The 2026 edition is a survey of 450 security leaders plus "thousands of real-world pentests" in a five-year dataset. Cobalt's blog post, dated 5 May 2026, does not give the exact pentest count. We read that post and not the 2026 PDF. The figures below from 2026 are therefore as Cobalt's blog reports them.

Time to resolve#

Cobalt 2025 states: "The median time to resolve (MTTR) stands at 67 days for all pentest findings." A median means half of findings took longer. Findings that stay open for months pull the average far above the median, which is why the report uses the median.

The 2026 post narrows the question to high-risk findings. It reports that resolving them takes 39 days. Cobalt also reports a half-life, "a measure of both speed and completeness." The best organizations reach 10 days. The worst tier takes 249 days, which Cobalt calls a 25x remediation gap and "eight extra months of risk exposure."

A useful reading for your own program: if your median time to fix a high-risk finding is above 39 days, you are slower than the Cobalt median. That comparison holds only if you measure from the report date to the verified fix.

Resolution rates#

Many findings never get fixed. Cobalt 2025 says: "Less than half (48%) of all findings ever get resolved. That jumps to 69% for the riskiest findings."

The 2026 post reports a different split. A typical organization fixes 86% of its high-risk findings. Across five years the overall rate "remains stuck at 52%." The two editions use different datasets and definitions, so the rise from 69% to 86% for the riskiest findings is not a trend. It is two measurements.

What this means for a report you receive: expect that low and medium findings are the ones most likely to stay open. Ask your tester which findings you must fix first, and plan a retest for the ones you close. Our guide on after the pentest: remediation and retest covers triage and close-out.

SLAs#

A fix SLA is a promised time from report to fix. Cobalt 2025 found that three-quarters of organizations set SLAs of two weeks or less. The 2026 post says targets are often set at 7 days.

Executives and practitioners disagree on whether teams meet them, according to the 2026 post.

The sample is the 450 security leaders in Cobalt's 2026 survey, and the post does not break the groups down further. Cobalt also reports that programmatic organizations are 4.5 times more likely to fix critical findings in three days or less, and that programmatic testers (53%) now outnumber compliance-driven ones (40%) for the first time.

Worked example: measuring your own time to fix#

Take six high-risk findings from a Harbor Notes report dated 1 March. Record the date each fix passed a retest.

The median of the five closed findings is 28 days. The sixth is still open, so the true median is at least 28 and may be higher. Count open findings in the resolution rate (5 of 6 resolved) and report both numbers.

AI and LLM findings#

Cobalt's figures for AI and LLM findings are worse than for other categories. Cobalt 2025 reports that 32% of LLM pentest findings are rated high risk, against 13% overall, and that 21% of the serious LLM findings get resolved (p.4).

The 2026 post reports 32% against 12%, which Cobalt calls nearly 2.7 times higher. It says AI and LLM findings have the lowest resolution rate of any category, at 38%. Confidence in AI security fell from 64% in 2025 to 51% in 2026. Cobalt's landing page and blog disagree on the ratio, so we quote the percentages and not the multiple.

For the LLM-specific data, see the figures on LLM security statistics.

How to cite#

Cite Cobalt, not this page, and include the edition. Example: "Cobalt, The State of Pentesting Report 2025, p.4: median time to resolve all findings 67 days; 48% of findings ever resolved. Vendor data, 450 survey responses, over 16,000 pentests." For other survey figures see penetration testing statistics. To read your own report first, see how to read a penetration testing report.