I Just Found Out What Happens to the Bugs I Report. It Changed How I Hunt.

HackerOne calls it "exposure debt." It grew 131% while fix times got 54% faster. The math doesn't work the way I thought it did.

I read HackerOne's annual report on a Wednesday and found a term I'd never heard before.

Exposure debt.

Not technical debt. Not financial debt. Exposure debt — the accumulated pile of validated vulnerabilities that organizations know about but haven't fixed yet.

The number that stopped me: it grew 131% in two years.

But here's the part that made me put my coffee down. Average resolution time improved by 54% — from 135 days down to 62 days.

They're fixing individual bugs faster than ever. And the backlog is still growing.

How That's Possible

I had to read the explanation twice.

The 62-day figure only counts reports that reached resolution. Simpler fixes close first. The harder findings — the ones that require more engineering effort, more coordination, more people to sign off — are the ones left waiting.

Meanwhile, new findings keep arriving faster than teams can clear them. Nearly 70% of security leaders confirmed this: validated findings are entering their systems faster than their teams can remediate them.

A team can get better at fixing bugs and still watch the pile grow. That's the trap.

Why This Matters to Me Specifically

I've found one confirmed bug. I'm waiting to be paid.

Reading about exposure debt, I felt something shift.

The question I'd been asking was: "How do I find more bugs?"

The better question — the one the data points to — is: "What happens to the bugs I find after I submit them?"

If my report enters a backlog and never gets fixed, I got paid. The triager did their job. But the vulnerability is still there. The data is still exposed. The system is still vulnerable.

I contributed to someone's backlog. Not to their security.

What the Report Says About Researchers Like Me

The HackerOne report includes data that feels personal.

85% of surveyed researchers are actively developing AI skills. Nearly three-quarters said AI meaningfully increased the valid findings they produce.

But 68% said they've shifted toward more complex bugs with higher bounties.

That's the signal. The researchers who are succeeding are going deeper, not wider. They're using AI to cover more ground, then focusing human judgment on the bugs that require creativity and context.

A top-earning researcher put it plainly: "AI hasn't replaced how I think as a security researcher. It's changed how much ground I can cover".

What I'm Doing Differently

I can't fix the remediation crisis. I can't force organizations to patch faster. But I can change three things.

First, I'm treating "reproducible" as a higher bar than "valid." A valid bug that takes an hour to reproduce is less useful than a valid bug with a one-line PoC. The easier I make it for a developer to fix, the more likely it actually gets fixed.

Second, I'm looking at remediation history, not just bounty size. A program that pays well but never patches is accumulating debt. A program with lower payouts but active patching is contributing to actual security.

Third, I'm remembering that the bottleneck isn't me. The report says nearly 70% of security leaders confirmed that validated findings are arriving faster than teams can fix them. My job isn't just to find bugs. It's to make the fix as easy as possible.

The Uncomfortable Truth

HackerOne paid a record $89 million to researchers this year. That's genuinely good news. The work is valued. Companies are still investing in finding bugs before attackers do.

But the 131% exposure debt increase tells a different story. It says the system is finding faster than it's fixing. It says the gap is growing.

The bugs I find aren't just entries in my report history. They're entries in someone's backlog. And if that backlog keeps growing, the whole system becomes unsustainable.

I don't have a CVE. I've found one confirmed bug. I'm still learning.

But I know what exposure debt means now. And I don't want to add to it.

If you're also learning bug bounty in a system where discovery outruns remediation, I write about what I'm actually figuring out — numbers included. Follow for more field notes from the bottom of the learning curve.