1,206 verified findings from 55 penetration tests, broken out by what was tested. Real engagements, proven findings, open methodology. No form between you and the data.
Four results that should change how you scope your next penetration test. Every number traces to the methodology in the full report.
69% surfaced at least one Critical finding. The real question is who finds the exploitable path first: your pentest, or someone you did not invite.
Internal networks fail on unpatched software, 57% of everything found. Web applications fail on authentication and authorization. Scope decides what you learn before a single request is sent.
Every finding ships with reproduction evidence and passes two stages of human review before a client sees it. That is the answer to scanner noise and unreviewed AI output: 9 false positives in 1,216 findings.
Teams clear the top of the queue and stall one tier below it, where most of the exploitable findings live. The slowest tenth of fixes ran past 120 days. A 30-day retest window never sees them.
The severity distribution across all 1,206 verified findings. Only 5 were logged as Informational, because informational observations rarely survive triage into a report.
The blended benchmark most vendors publish describes an engagement nobody buys. Median findings and severity split sharply by what you put in scope. The full report holds seven figures like this, with the methodology and limitations alongside.
Source: Stingrai PTaaS platform data, October 2024 to August 2026.
The full report is public, with every chart, the methodology and the limitations, because numbers you cannot check are marketing. If a designed PDF travels better inside your organization, we will email it, along with each quarterly data refresh. Business email only.
One web application and its APIs, tested by Snipe and human penetration testers. Every finding proven, retests included.
