The Detectify Cyber Hygiene Index Report H2 2026 measures something most reports ignore: not what happened after an attack, but what’s exposed right now, before one occurs. We analyzed anonymized data from a sample of +1290 organizations across the US, UK, and Nordics to understand how effectively they’re finding, monitoring, and closing vulnerabilities across their external attack surfaces.

The findings reveal a pattern: 97% of open critical and high-severity vulnerabilities in the Nordics have remained exposed for over 90 days. In the UK, that’s 92%. Even in the best-performing market, the US, it’s 86%. Our findings point towards stalling remediation rather than failing detection.

Visibility doesn’t fix vulnerabilities

The UK monitors 72% of its verified attack surface (more than double the rate in the US and Nordics). That’s strong visibility. Yet the UK has the lowest vulnerability resolution rate of the three markets. The contrast is revealing: organizations can be excellent at finding exposure and terrible at closing it. These are separate skills, and most teams are unbalanced.

The US has the opposite problem. We measured the largest attack surface in the Index, yet only 29% of it is actively monitored. Worse, that attack surface grew 20% in a single year. Organizations are spinning up infrastructure faster than they can see it, let alone secure it.

Backlogs don’t predict response speed

Consumer brands carry the heaviest vulnerability backlogs of any sector, yet they resolve critical and high-severity findings at 46.2%, the fastest rate in the Index. Public-sector organizations resolve just 8.3%. The lesson: the size of your backlog tells you nothing about how fast you’ll fix your worst problems. One sector is drowning but moving. The other isn’t.

Manufacturing is the only sector to perform well across every market with sufficient data. Tech companies struggle with asset completeness. Financial institutions vary sharply by geography. The index shows that cyber hygiene isn’t a single problem to solve, it’s the ability to connect visibility, prioritization, and remediation across an attack surface that won’t stop changing.

AI exposure is slowing fixes

We’re seeing an emerging threat: publicly exposed self-hosted AI platforms and AI-built applications scattered across production networks. Early signs point that organizations with exposed AI tooling resolve critical and high-severity vulnerabilities at less than half the rate of the broader customer base. It’s not clear whether this is a staffing problem, a prioritization problem, or AI projects just landing in security-blind spots. Either way, it’s a compounding risk as AI adoption accelerates.

What this means

Nine in ten critical and high-severity vulnerabilities currently exposed have been sitting there for more than 90 days, which points to an execution problem, it being ownership, remediation resourcing, or risk tolerance that drifts until unaddressed vulnerabilities become accepted defaults.

Because these specific assessments test real-world exploitability through 100% payload-based methodology, organizations know these backlog vulnerabilities are verified risks. However, a delayed fix does not always signal inaction; a technically critical vulnerability on a low-sensitivity asset or behind compensating controls may reflect a calculated business decision to deprioritize risk based on internal context.

The data suggests that the harder test of cyber hygiene increasingly comes after discovery. Finding exposure is necessary, but closing it is harder.

Read and download the report here to discover sector breakdowns, cross-market findings, and many other insights.

The post Detectify Cyber Hygiene Index Report reveals that most critical vulnerabilities sit unfixed for months appeared first on Blog Detectify.

A staging site is meant to last a week, but six months later, it still resolves on a company subdomain, runs an old framework, and has no clear owner. The asset never made it into the central inventory, which means that it also missed the normal cycle of testing, patching, and retirement.

That is how many Shadow IT Security problems develop. The original shortcut may have been reasonable, but the risk grows when temporary infrastructure becomes part of the permanent attack surface without anyone noticing.

Security teams often respond by tightening approval processes or reminding teams about policy, and those controls can reduce the use of unmanaged technology. They cannot, however, keep an inventory perfectly aligned with a business that changes every day, so Shadow IT Security has to account for the gap between what the organization believes it owns and what is actually exposed.

Shadow IT grows where teams hit friction

Most unmanaged technology has a practical origin rather than a dramatic one. A developer needs somewhere to run a short-lived job, a product team wants to test a SaaS service before procurement is finished, or an acquired company still has applications running under domains that never entered the parent company’s security tooling.

Naturally, governance still matters: procurement reviews, identity controls, cloud policies, and approved tooling reduce avoidable risk, but they cannot show everything running today. A useful Shadow IT Security program has to work with that reality rather than assume every asset will pass through the same process before it appears online.

The priority changes once unmanaged infrastructure becomes reachable from the internet, because an overlooked service can create the same exposure as any formally managed production system while receiving far less scrutiny.

Exposure is where the risk becomes real

An unused SaaS account and a forgotten public-facing test server do not deserve the same response, which is why exposure and business context matter. The weaknesses themselves are usually familiar: a test application has no authentication, a storage bucket exposes files, a database accepts public connections, or a legacy API still runs an old framework because nobody owns the upgrade.

Known systems can suffer from the same problems, but they are more likely to be monitored, scanned, patched, and assigned to an owner. Shadow assets often sit outside those routines, which means a relatively ordinary configuration mistake can remain in place for much longer.

For Shadow IT Security, the important window is the time between an asset becoming exposed and somebody taking responsibility for it. Shortening that window gives security a better chance of fixing routine mistakes during normal work instead of investigating them after an incident.

The inventory ages quickly

An inventory records what teams registered and what security knew during the last review, so it remains useful as a management tool, but it should not be treated as a complete picture of the external environment. Test environments stay online, domains survive migrations, partners launch infrastructure under company-owned subdomains, and acquisitions bring services that may never reach the central security team.

Point-in-time audits have the same limitation because they capture a moment while the attack surface continues to change. The findings may be accurate on the day of testing and incomplete a week later, which is why Shadow IT Security benefits from an outside-in view alongside internal records.

Better attack surface visibility helps security teams see domains, services, and infrastructure that never reached the central inventory, while effective shadow IT detection looks for public signals that connect those assets back to the organization. External attack surface monitoring can then surface domains, IP addresses, certificates, DNS records, open ports, services, and exposed technologies that internal records may miss.

That visibility only becomes useful when it changes what the team does next.

Move from discovery to ownership

A discovery feed can become another source of noise when every new asset lands in a backlog without context, so Shadow IT Security needs a process that connects discovery directly to a decision. In practice, that means moving through a small number of steps:

1. Discover the asset: identify new or changed internet-facing infrastructure and determine whether the signal is worth investigating.
2. Confirm ownership and context: establish whether the asset belongs to the organization, whether it is still active, and what role it plays.
3. Assess the exposure: understand what is running, how reachable it is, and whether the asset needs deeper application or API testing.
4. Assign and resolve: route verified issues to the team that can act, then patch, restrict, monitor, or retire the asset and confirm the change.

This gives Shadow IT Security a route from discovery to ownership and remediation instead of simply producing a larger asset list, while also making it easier to distinguish a forgotten but harmless domain from an exposed application that needs immediate attention.

Detectify supports this part of the process by helping teams discover and monitor internet-facing assets, while deeper application and API testing can provide more evidence when surface-level checks are not enough. Within a Shadow IT Security program, that can help connect an unexpected asset with the next security action rather than leaving it as another unexplained item in an inventory.

External monitoring still has limits because it will not uncover every unsanctioned SaaS account, unmanaged endpoint, or isolated cloud resource. Shadow IT Security therefore works best alongside identity data, endpoint controls, cloud governance, procurement records, and cooperation from engineering teams, each of which covers a different part of the problem.

Measure how long the gap stays open

Raw asset counts can be misleading because finding more assets may reflect a growing attack surface, better discovery, or both. Shadow IT Security metrics should instead show how quickly the team turns uncertainty into ownership and action.

Time to discovery, time to confirmed ownership, and time to remediation are more useful than the total number of assets in a dashboard, while exposed systems with no owner and assets that return after retirement can reveal where the underlying process is failing.

The goal is to reduce the gap between what the business exposes and what security understands. Shadow IT will continue to appear as teams ship software, adopt services, and acquire companies, so the value of Shadow IT Security is measured by how quickly those changes become visible and how long unmanaged exposure is allowed to remain unresolved.

Take control of your exposed attack surface

Don’t let forgotten staging sites or unmanaged cloud assets put your enterprise at risk. Detectify gives you the automated visibility and deep application testing required to bridge the gap between discovery and remediation.

Ready to see it in action? Book a demo with our application security experts to explore a tailored walk-through.
Want to test your environment today? Start a free trial and instantly map your external assets with zero friction.

Frequently asked questions 

What is Shadow IT Security?

Shadow IT Security is the practice of finding, assessing, and reducing risk from technology outside normal IT or security oversight, including applications, APIs, cloud infrastructure, domains, and SaaS services.

Can shadow IT be eliminated?

Probably not completely. Organizations can reduce it by removing unnecessary friction, while Shadow IT Security provides a way to find assets that still appear outside approved processes and bring them into normal ownership and remediation workflows.

Is attack surface monitoring enough?

No. It cannot see every SaaS account, endpoint, or isolated cloud resource, so Shadow IT Security works best alongside identity, endpoint, cloud, and procurement controls.

How does Detectify help with Shadow IT Security?

Detectify can discover and monitor internet-facing assets, then support deeper testing of relevant web applications and APIs where more validation is needed.

Which Shadow IT Security metrics matter most?

Time to discovery, ownership, and remediation shows how long unmanaged exposure remains unresolved and whether Shadow IT Security is reducing that window over time.

The post Shadow IT Security and why visibility beats another approval process appeared first on Blog Detectify.