State of Pentesting Report 2025
Partner: Cobalt Labs
The State of Pentesting Report 2025 sets what security leaders believe about their programs against a decade of Cobalt pentest results. The median finding takes 67 days to resolve, about five times the two-week SLA most organizations set for themselves. The analysis covers more than 16,000 pentests alongside a survey of 450 security leaders and practitioners.
Most respondents believe their security posture meets regulatory requirements, yet every pentest in the sample turned up at least one reportable issue. Where programs fall short is mostly in follow-through after the report lands. Serious findings get fixed much faster than they did in 2017, but the share resolved at all has hovered near the same level for years. AI and LLM applications show the gap most clearly, since nearly every firm is building genAI into its products while LLM pentests produce the highest share of serious findings and the lowest resolution rate of any test type.
The full report breaks down the most common findings for web and API, mobile, and AI and LLM pentests, then compares resolution rates and MTTR by test type, sector and organization size. It estimates the half-life of findings with survival analysis and closes with recommendations for running pentesting as a program.
Key Findings
- 5x the SLA Window: The median time to resolve all pentest findings is 67 days, about five times the two-week SLA set by three-quarters of organizations.
- 48% Ever Resolved: Less than half (48%) of pentest findings get resolved, rising to 69% for serious (high and very high risk) findings.
- 2.5x AI Risk Rate: 32% of AI and LLM pentest findings are rated serious, about 2.5 times the 13% rate across all pentests.
- 21% AI Resolution: Only 21% of serious findings from AI and LLM pentests get resolved, the lowest rate of any pentest type.
- Serious Fixes 3x Faster: The median time to resolve serious findings fell from 112 days in 2017 to 37 days in 2024.
- Size Penalty: Organizations with more than 5,000 employees take a median 61 days to resolve serious findings, versus 27 days for those with 100 or fewer.
Independent analysis by Cyentia Institute of more than 16,000 Cobalt pentests of 2,700+ organizations over 10 years, plus a double-blind survey of 450 security leaders and practitioners.
Key Risk Insight
Most organizations expect pentest findings fixed within weeks, but the typical finding stays open for months and many never close. Track the share of serious findings actually resolved, not only whether the test was done.
Cite this report: Cyentia Institute and Cobalt Labs (2025). State of Pentesting Report 2025. https://www.cyentia.com/publication/2025-state-of-pentesting-report/