We spent this year watching what actually happens when organizations stop assuming their defenses work and start proving it.
The findings come from design partner deployments across SaaS, financial services, healthcare, and government. The short version is uncomfortable. The distance between assumed security and validated security is wider than most programs think, and it is wider at the top of the maturity curve than anyone expects.
Finding one, coverage is claimed more than it is confirmed
Detection coverage numbers are one of the most trusted metrics in security, and one of the least tested. Across deployments, a meaningful share of controls that reported full coverage failed to detect the behavior they were supposed to catch when it was actually validated.
Coverage on a dashboard is a plan. Coverage under validation is a fact. They are rarely the same number.
Finding two, severity does not equal exploitability
Programs continue to triage by severity score, and attackers continue to ignore it. The exposures that mattered most in real environments were often not the highest scored. They were the ones where reachability, runtime presence, and toxic combinations lined up into a real path.
Severity tells you how bad something could be in theory. Validation tells you whether it is reachable in practice.
Finding three, maturity raises confidence faster than it raises proof
The most surprising pattern was that more mature programs were often more confident and not proportionally more validated. Better tooling produced more findings and more certainty, without necessarily producing more evidence.
Confidence without evidence is the most expensive risk a program can carry, because no one thinks to question it.
What the data argues for
The findings point in one direction. Validation has to become continuous, evidence-backed, and governed, rather than periodic and assumed.
Continuous
Estates change weekly, so a point-in-time result expires almost immediately.
Evidence-backed
Every claimed outcome carries a record that survives the moment of the test.
Governed
Scope, approvals, and safety defined up front, so continuous stays safe.
The programs that closed the gap fastest were the ones that treated every claimed outcome as a hypothesis to be tested, not a status to be reported.
Findings at a glance
| Finding | What programs assume | What validation showed |
|---|---|---|
| Coverage | Controls reporting full coverage detect the behavior they map to. | A meaningful share failed to detect it when actually tested. |
| Severity | The highest scored exposures are the ones to fix first. | The exposures that mattered were reachable, not necessarily severe. |
| Maturity | Better tooling means a better validated program. | Confidence outpaced evidence, and the gap grew with maturity. |
FAQ
Where does the data come from?
From Hayrok design partner deployments across SaaS, financial services, healthcare, and government environments.
What is the exploitability gap?
It is the difference between exposures that look severe on paper and exposures that are actually reachable and validated in a real environment.
Why does maturity not close the gap on its own?
More mature programs tend to generate more findings and more confidence, but confidence is not evidence. Without validation, the gap can grow quietly.
Find out where your own gap sits.
The full report includes the metrics behind each finding and the benchmark ranges we measured against.
Hayrok Labs
The full breakdown, including the metrics behind each finding, lives on the blog. Subscribe to get next year's data as it lands, and the working analysis before it is published anywhere else.
More announcements
Evidence Fabric moves to general availability
Every validated outcome now carries a complete, correlatable evidence contract.
AWS Marketplace and six MSSP launch partners
Easier to procure, easier to deploy, available as a managed outcome.
From CVSS to reachability
Why the score you triage on is not the risk you carry.