Why a Quarter of Security Flaws Are Never Fully Fixed
ITPro, Wednesday, November 4th, 2026
SecureFlag research finds a quarter of developer vulnerability fixes fail, raising concerns about verifying fixes delegated to AI.
SecureFlag analyzed 805,663 attempts by developers to fix security flaws on its training platform over two years and found that about a quarter were incorrect or incomplete.
When developers got a fix wrong without asking for a hint, it suggested they did not realize the fix had failed.
SecureFlag CTO Emilio Pinna said this remaining quarter is the work increasingly delegated to AI tools, and developers who cannot fix a vulnerability themselves cannot reliably verify an AI fix either.
The report suggests hint rate may matter more than solve rate as a measure of developer understanding.