New figures from Check Point show that the number of critical vulnerabilities in organizations has more than doubled due to AI-driven cyberattacks. Yet, only a small minority of alerts prove so urgent that immediate action is required.
According to Check Point Software Technologies’ ‘Under Pressure: The 2026 Exposure Gap Report’, the gap between detection and effective response in security teams is growing. Through the use of artificial intelligence and automation, cybercriminals can exploit vulnerabilities faster and on a larger scale than ever before. As a result, organizations receive more alerts but must prioritize more sharply.
Critical vulnerabilities and the prioritization gap
The share of critical vulnerabilities has risen from 18 to over 42 percent of all critical risks in one year. However, closer inspection reveals that only 7.8 percent of alerts are truly urgent. More than 90 percent do not require immediate remediation, highlighting the need for automated and targeted prioritization.
Most risks appear to be concentrated in two categories: vulnerabilities and exposed internal information, together accounting for 76 percent of critical exposures. Phishing in particular is growing remarkably fast: the share of phishing websites within critical reports rose from 1 to 10.5 percent in a single year.
Sectoral differences and remediation measures
The report shows that risks vary significantly by sector. In utilities and government, vulnerabilities account for up to 78 and 56 percent of critical exposures respectively, while in healthcare and the financial sector, internal information is most dominant. Furthermore, healthcare is the most difficult sector for rapid recovery: the median recovery time there is 155 hours.
Nevertheless, organizations implement an average of over 85 percent of recommended remediation measures, indicating that a clear response strategy pays off. According to Check Point, organizations must align their exposure management with their specific risks and operational reality.