{
  "dataset": "The State of Penetration Testing 2026: aggregate dataset",
  "edition": "First edition, published August 2026",
  "publisher": "Stingrai (https://www.stingrai.io)",
  "report": "https://www.stingrai.io/reports/state-of-penetration-testing-2026",
  "article": "https://www.stingrai.io/blog/state-of-penetration-testing-2026",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/",
    "citation": "Stingrai, The State of Penetration Testing 2026. https://www.stingrai.io/reports/state-of-penetration-testing-2026"
  },
  "methodology_notes": [
    "Window: October 2024 to August 2026, from Stingrai's PTaaS platform.",
    "Base: 55 penetration tests; 1,216 logged findings of which 1,206 were verified through two-stage human review (9 false positives, 1 duplicate).",
    "Aggregates only: the dataset contains no client names, no per-engagement rows, and no fields that could identify any organization.",
    "Mobile is included in corpus totals but is too small to segment (one test).",
    "Remediation figures cover the tracked subset (n=163) where resolution was recorded.",
    "One record documents a control verified effective (network segmentation); it is counted in the 1,206 and disclosed here rather than hidden."
  ],
  "headline": {
    "penetration_tests": 55,
    "logged_findings": 1216,
    "verified_findings": 1206,
    "false_positive_rate_pct": 0.74,
    "tests_with_high_or_critical": {
      "count": 51,
      "share_pct": 92.7
    },
    "tests_with_critical": {
      "count": 38,
      "share_pct": 69.1
    },
    "high_or_critical_share_of_findings_pct": 67.2,
    "median_findings_per_test": 8
  },
  "severity_distribution": [
    {
      "severity": "Critical",
      "verified_findings": "368",
      "share_of_findings_pct": "30.5"
    },
    {
      "severity": "High",
      "verified_findings": "442",
      "share_of_findings_pct": "36.7"
    },
    {
      "severity": "Medium",
      "verified_findings": "235",
      "share_of_findings_pct": "19.5"
    },
    {
      "severity": "Low",
      "verified_findings": "156",
      "share_of_findings_pct": "12.9"
    },
    {
      "severity": "Informational",
      "verified_findings": "5",
      "share_of_findings_pct": "0.4"
    }
  ],
  "class_mix": [
    {
      "class_group": "Configuration, exposure and disclosure",
      "verified_findings": "299",
      "share_of_findings_pct": "24.8"
    },
    {
      "class_group": "Authentication and session",
      "verified_findings": "253",
      "share_of_findings_pct": "21.0"
    },
    {
      "class_group": "Outdated or unpatched software",
      "verified_findings": "252",
      "share_of_findings_pct": "20.9"
    },
    {
      "class_group": "Injection and client-side execution",
      "verified_findings": "218",
      "share_of_findings_pct": "18.1"
    },
    {
      "class_group": "Authorization and access control",
      "verified_findings": "151",
      "share_of_findings_pct": "12.5"
    },
    {
      "class_group": "Business logic",
      "verified_findings": "22",
      "share_of_findings_pct": "1.8"
    },
    {
      "class_group": "Denial of service",
      "verified_findings": "10",
      "share_of_findings_pct": "0.8"
    },
    {
      "class_group": "Control verified effective",
      "verified_findings": "1",
      "share_of_findings_pct": "0.1"
    }
  ],
  "critical_anatomy": [
    {
      "class": "Authentication and session",
      "critical_findings": "105",
      "share_of_critical_findings_pct": "28.5",
      "share_of_class_rated_critical_pct": "41.5"
    },
    {
      "class": "Outdated or unpatched software",
      "critical_findings": "87",
      "share_of_critical_findings_pct": "23.6",
      "share_of_class_rated_critical_pct": "34.5"
    },
    {
      "class": "Injection and client-side execution",
      "critical_findings": "61",
      "share_of_critical_findings_pct": "16.6",
      "share_of_class_rated_critical_pct": "56.5"
    },
    {
      "class": "Broken access control",
      "critical_findings": "34",
      "share_of_critical_findings_pct": "9.2",
      "share_of_class_rated_critical_pct": "40.0"
    },
    {
      "class": "Misconfiguration and hardening",
      "critical_findings": "21",
      "share_of_critical_findings_pct": "5.7",
      "share_of_class_rated_critical_pct": "12.8"
    },
    {
      "class": "Information disclosure",
      "critical_findings": "21",
      "share_of_critical_findings_pct": "5.7",
      "share_of_class_rated_critical_pct": "18.8"
    },
    {
      "class": "IDOR",
      "critical_findings": "16",
      "share_of_critical_findings_pct": "4.3",
      "share_of_class_rated_critical_pct": "24.2"
    },
    {
      "class": "Other",
      "critical_findings": "23",
      "share_of_critical_findings_pct": "6.3",
      "share_of_class_rated_critical_pct": ""
    }
  ],
  "test_types": [
    {
      "test_type": "Web Application",
      "verified_findings": "768",
      "pentests_with_findings": "40",
      "median_findings_per_test": "8",
      "share_high_or_critical_pct": "54"
    },
    {
      "test_type": "Internal Network",
      "verified_findings": "408",
      "pentests_with_findings": "8",
      "median_findings_per_test": "11",
      "share_high_or_critical_pct": "92"
    },
    {
      "test_type": "External Network",
      "verified_findings": "23",
      "pentests_with_findings": "6",
      "median_findings_per_test": "1",
      "share_high_or_critical_pct": "48"
    },
    {
      "test_type": "Mobile",
      "verified_findings": "7",
      "pentests_with_findings": "1",
      "median_findings_per_test": "",
      "share_high_or_critical_pct": ""
    }
  ],
  "remediation": [
    {
      "severity": "Critical",
      "tracked_findings": "18",
      "median_days_to_resolve": "10.5",
      "p90_days_to_resolve": "92.2"
    },
    {
      "severity": "High",
      "tracked_findings": "41",
      "median_days_to_resolve": "38.0",
      "p90_days_to_resolve": "125.0"
    },
    {
      "severity": "Medium",
      "tracked_findings": "58",
      "median_days_to_resolve": "26.0",
      "p90_days_to_resolve": "126.4"
    },
    {
      "severity": "Low",
      "tracked_findings": "46",
      "median_days_to_resolve": "23.5",
      "p90_days_to_resolve": "51.0"
    }
  ]
}