Recent analysis of about 1,000 companies found just 13% of vulnerabilities observed were remediated and took an average of 271 days for security teams to address them. Organizations are racing to remediate thousands of vulnerabilities each month, yet the growing backlog now outstrips their ability to keep pace. With threat actors looking for any weakness to exploit, this backlog of un-remediated vulnerabilities poses a serious security risk. So to shrink this remediation gap, we must first understand what’s behind the disconnect. The widening gap has been driven by a number of important elements, including a lack of time and resources, and the need to balance security risk and functional risk.