# Vulnerability backlog risk: nearly half of large-enterprise security teams close or deprioritize unverified findings (ProjectDiscovery survey)

> A ProjectDiscovery survey reported by Help Net Security on 2026-11-11 finds nearly half of security teams at organizations with 5,000+ employees close or deprioritize vulnerability findings without fully verifying them, citing lack of time. Three in four respondents say their backlog grew over the past year, while Mandiant M-Trends 2026 shows exploitation of vulnerabilities occurring at or before patch availability.

- **Published:** 2026-11-11T05:50:35Z
- **Last reviewed:** 2026-11-11T05:50:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5730
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5730.png
- **ID:** TL-2026-5730
- **Severity:** INFO
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (1 shown free below)

## Description

This is an industry survey / trend report, not a specific exploited vulnerability or campaign. No CVEs, malware families, network indicators, or threat actor attribution are stated in the sources. It is published as vulnerability-management risk context for defenders.

Survey findings reported by Help Net Security (Mirko Zorz, 2026-11-11) from a ProjectDiscovery survey: nearly half of security teams at organizations with 5,000+ employees close or deprioritize findings without fully verifying them, and the reason given is time. Among those teams, 57% say at least three in four of the findings they do check are real. Three in four respondents say their backlog grew over the past year, with a large share of new findings coming from AI testing tools. Most large enterprises have more than 1,000 untriaged findings and about a quarter have more than 10,000. Nearly all respondents say at least one in ten findings is fake or unexploitable, and over a third say it is more than one in four. Seven in ten teams draw findings from three or more sources (scanners, bug bounties, pentests, customer reports); teams with five or more sources are nearly twice as likely as teams with one or two to close findings without full verification. More than half of security leaders admit to closing or deprioritizing unverified findings versus about a third of practitioners. Nearly nine in ten teams that skip verification worry real vulnerabilities are hiding in the backlog, and half of all respondents say hiring more people would not fix the problem. Nearly half say AI is adding findings to their workload, and more than half expect attackers using AI to reach backlog issues before their own teams do. Just over a third say AI helps them triage faster; those teams are less than half as likely to feel bad about their backlog.

Threat-speed context: the article cites Mandiant as reporting an average of 7 days to exploit a vulnerability in 2025 versus 63 days in 2018. Analyst note: Google Cloud's M-Trends 2026 blog (published 2026-03-23) states that the mean time to exploit dropped to an estimated -7 days, meaning exploitation is routinely occurring before a patch is released, and it does not mention the 2018/63-day comparison; the primary report should be checked before citing either figure. The same M-Trends release reports exploits as the most common initial infection vector for the sixth consecutive year (32% of intrusions), global median dwell time rising to 14 days from 11, and the hand-off window between initial access and a secondary threat group collapsing from more than 8 hours in 2022 to 22 seconds in 2025.

Related ProjectDiscovery research (2026 AI Coding Impact Report, 200 practitioners, released 2026-04-22 per press coverage) found 66% of practitioners spend more than half their time manually validating findings instead of fixing vulnerabilities. This is a different survey from the one in the Help Net article; the article does not give the title of the report it draws on. Defensive implication: unverified closed or shelved findings may include exploitable issues that attackers can reach faster than the backlog is triaged, so verification, exploitability-based prioritization, and validation tooling matter.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1566.004 Spearphishing Voice

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web Server Process Spawning Shell or Recon LOLBin — Exploitation of Public-Facing Application (T1190)** (`TL-2026-5730-SPL-001`)

Detects an internet-facing web/application server process (w3wp, httpd, nginx, Tomcat, java, php-cgi) spawning a command interpreter or reconnaissance/download binary. This is the canonical post-exploitation behaviour of T1190 exploitation, which M-Trends 2026 reports as the top initial access vector (32% of intrusions), often before a patch exists. Relevant to TL-2026-5730 where unverified, shelved findings on exposed assets are reached by attackers first. Behaviour-first: no CVE-specific signature required.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ```comment TL-2026-5730 T1190: web server worker process spawning interpreter or recon binary```
  (ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*\\tomcat*.exe" OR ParentImage="*\\java.exe" OR ParentImage="*\\php-cgi.exe")
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\mshta.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\nltest.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_line by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| sort - count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe","httpd.exe","nginx.exe","tomcat9.exe","tomcat10.exe","java.exe","php-cgi.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","mshta.exe","whoami.exe","net.exe","net1.exe","nltest.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Web Server Process Spawning Shell or Recon Binary (Windows)
id: 5b1f0a52-7c3e-4d5a-9f10-6a2b8e4c1d01
status: experimental
description: Detects web server worker processes spawning command interpreters or recon/download LOLBins, indicating exploitation of a public-facing application (TL-2026-5730 / T1190).
references:
    - https://www.helpnetsecurity.com/2026/11/11/security-teams-vulnerability-backlog/
    - https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\tomcat9.exe'
            - '\tomcat10.exe'
            - '\java.exe'
            - '\php-cgi.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\mshta.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate application deployment or health-check scripts launched by IIS/Tomcat
    - Admin-initiated maintenance via web-based management consoles
level: high

```

**Known false positives:**

- Legitimate application deployment or health-check scripts launched by IIS/Tomcat
- Web-based admin consoles that intentionally shell out (backup, diagnostics)

**Tuning notes:** Allowlist known ParentCommandLine/app-pool and CommandLine pairs for approved health checks; scope to internet-facing hosts via a lookup; raise to critical when Image is powershell/certutil with an HTTP URL.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vulnerability Scanner Activity Against Web Servers — Active Scanning Precursor to Exploitation (locked: unlock with TL Creds)
- Web Server Process Downloading Payloads via LOLBins — Post-Exploitation Tool Transfer (locked: unlock with TL Creds)
- Remote Support Tool Followed by Script Interpreter — Voice-Phishing Hand-Off (locked: unlock with TL Creds)
- Linux Web Server Process Spawning Shell — Exploitation of Public-Facing Application (locked: unlock with TL Creds)
- Web Server Process Creating Scheduled Task or Service — Persistence After Exploitation (locked: unlock with TL Creds)
- Remote Service Installation via ADMIN$ or PsExec-Style Service — Lateral Movement (locked: unlock with TL Creds)
- Web Shell Dropped in Web Root by Web Server Process — Post-Exploitation Persistence (locked: unlock with TL Creds)
- Periodic Beacon-Like Outbound Traffic from Server Zone — Command and Control (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 13)

Defanged, TLP:CLEAR.

- URL: `hxxps://www[.]helpnetsecurity[.]com/2026/11/11/security-teams-vulnerability-backlog/`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Nearly half of big firms shelve or close vulnerability findings they haven't confirmed (Help Net Security, Mirko Zorz)](https://www.helpnetsecurity.com/2026/11/11/security-teams-vulnerability-backlog/)
- [M-Trends 2026: Data, Insights, and Strategies From the Frontlines (Google Cloud / Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026)
- [Attackers are handing off access in 22 seconds, Mandiant finds (Help Net Security)](https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/)
- [The AI Code Deluge: 2026 AI Coding Impact Report (ProjectDiscovery)](https://projectdiscovery.io/research/ai-coding-impact-report)
- [AI coding speeds up but security teams fall behind (IT Brief Australia, ProjectDiscovery survey coverage)](https://itbrief.com.au/story/ai-coding-speeds-up-but-security-teams-fall-behind)
- [The trust gap behind the AI coding boom: what 200 security practitioners just told us (ProjectDiscovery blog)](https://projectdiscovery.io/blog/the-trust-gap-behind-the-ai-coding-boom-what-200-security-practitioners-just-told-us)
- [When Discovery Is Cheap, Validation Is Priceless for Reducing Risk (HackerOne)](https://www.hackerone.com/blog/ctem-validation-return-on-mitigation)
- [Kara Sprague, HackerOne: AI bug bounty (Help Net Security, linked from source article)](https://www.helpnetsecurity.com/2026/11/03/kara-sprague-hackerone-ai-bug-bounty/)
- [Kunal Modasiya, Qualys: vulnerability remediation (Help Net Security, linked from source article)](https://www.helpnetsecurity.com/2026/10/14/kunal-modasiya-qualys-vulnerability-remediation/)
- [Contrast Security: AI AppSec tools and security findings report (Help Net Security, linked from source article)](https://www.helpnetsecurity.com/2026/08/31/contrast-security-ai-appsec-tools-security-findings-report/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5730