I Just Learned a Term That Changed How I Think About Every Report I Submit.

HackerOne calls it "exposure debt." It grew 131% in two years. And I've been contributing to it without knowing.

I read HackerOne's annual report on a Wednesday morning and found a term I'd never heard before.

Exposure debt.

Not technical debt. Not financial debt. Exposure debt — the accumulation of validated vulnerabilities that organizations know about but haven't fixed yet.

The report found that this backlog grew 131% in two years.

But here's the part that made me put my coffee down: average resolution time improved by 54%. Organizations are fixing individual bugs faster than ever — from 135 days down to 62 days.

They're fixing each bug faster. They're fixing fewer bugs overall.

The backlog grew 21x. Unresolved criticals grew 25x.

I sat there staring at those numbers for a long time.

What This Actually Means

Let me walk through the mechanics, because I had to read the report twice to understand.

Every time a researcher submits a valid bug, it enters a queue. A triager validates it. It gets assigned to a developer. The developer fixes it. The bug leaves the queue. Success.

That's the theory.

The reality: validated findings are arriving faster than teams can resolve them. Nearly 70% of security leaders confirmed this.

The queue isn't just growing. It's growing faster than the fixing capacity can keep up, even though the fixing capacity itself is improving.

It's like a bathtub. The drain is wider than it's ever been. But the faucet is running at a rate the drain was never designed for.

Why I Care About This Specifically

I've found one confirmed bug. I'm waiting to be paid.

Reading about exposure debt, I felt something shift.

The question I'd been asking was: "How do I find bugs?"

The better question — the one the data points to — is: "What happens to the bugs I find after I submit them?"

If my report enters a backlog and never gets fixed, I got paid. The triager did their job. But the vulnerability is still there. The data is still exposed. The system is still vulnerable.

I contributed to someone's backlog. Not to their security.

What the Report Says About Researchers Like Me

The HackerOne report includes data that feels personal.

85% of surveyed researchers are actively developing AI skills. Nearly three-quarters said AI meaningfully increased the valid findings they produce.

But 68% said they've shifted toward more complex bugs with higher bounties.

That's the signal. The researchers who are succeeding are going deeper, not wider. They're using AI to cover more ground, then focusing human judgment on the bugs that require creativity and context.

A top-earning researcher put it plainly: "AI hasn't replaced how I think as a security researcher. It's changed how much ground I can cover".

What I'm Doing Differently

I can't fix the remediation crisis. I can't force organizations to patch faster. But I can change three things.

First, I'm treating "reproducible" as a higher bar than "valid." A valid bug that takes an hour to reproduce is less useful than a valid bug with a one-line PoC. The easier I make it for a developer to fix, the more likely it actually gets fixed.

Second, I'm looking at remediation history, not just bounty size. A program that pays well but never patches is accumulating debt. A program with lower payouts but active patching is contributing to actual security.

Third, I'm remembering that the bottleneck isn't me. The report says nearly 70% of security leaders confirmed that validated findings are arriving faster than teams can fix them. My job isn't just to find bugs. It's to make the fix as easy as possible.

The Uncomfortable Truth

HackerOne paid a record $89 million to researchers this year. That's genuinely good news. The work is valued. Companies are still investing in finding bugs before attackers do.

But the 131% exposure debt increase tells a different story. It says the system is finding faster than it's fixing. It says the gap is growing.

The bugs I find aren't just entries in my report history. They're entries in someone's backlog. And if that backlog keeps growing, the whole system becomes unsustainable.

I don't have a CVE. I've found one confirmed bug. I'm still learning.

But I know what exposure debt means now. And I don't want to add to it.

If you're also learning bug bounty in a system where discovery outruns remediation, I write about what I'm actually figuring out — numbers included. Follow for more field notes from the bottom of the learning curve.