Topic starter
20/08/2026 6:09 pm
TL;DR: 81% of organisations still ship vulnerable code because deadline pressure, late discovery, and remediation bottlenecks keep fixes from landing before release, according to Pixee. Security programmes need enough fix throughput to turn findings into reductions in exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Pixee: “81% Ship Vulnerable Code. The Problem Isn't Negligence—It's Capacity.”.
Key questions
Q: Why does deadline pressure increase the risk of shipping vulnerable code?
A: Deadline pressure changes the trade-off from ideal remediation to acceptable loss.
Q: How do security teams know whether Teams remediation is working?
A: They should measure dwell time, removal latency, and the percentage of malicious messages removed before any user interaction.
Q: What breaks when AppSec teams can find vulnerabilities faster than they can fix them?
A: The control loop breaks.
Practitioner guidance
- Define remediation capacity as a control metric Track how many findings engineering teams can actually close per sprint or release cycle, then compare that against new vulnerability intake to expose the real backlog pressure.
- Prioritise by deployment context, not severity alone Rank vulnerabilities by where they sit in the architecture, whether compensating controls exist, and how much access or data exposure they create in practice.
- Automate the lowest-friction fixes first Use automation for dependency updates, safe patching, and validation so that scarce engineering time is reserved for the cases that truly need human judgment.
Bottom line: The article argues that vulnerable-code shipping is mainly a capacity problem, where remediation work cannot keep pace with the volume of findings.
Glossary terms: Remediation capacity, Security Backlog, Context-Aware Prioritization, Remediation Throughput
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
20/08/2026 6:45 pm
Capacity, not negligence, is the real failure mode: organisations ship vulnerable code when remediation demand exceeds engineering throughput. The article is right to push back on moralised explanations, because shame does not change backlog physics. For security leaders, the implication is clear: if the fix queue cannot be cleared, the control has failed before release.
A question worth separating out:
Q: Should organisations automate remediation or keep it manual?
A: Start with automated triage and low-risk fixes, then reserve manual review for high-impact exceptions. Automation is most useful when it removes unused access, highlights policy violations, and shortens time to action, but humans still need to decide on edge cases where business context changes the risk.
👉 Read our full editorial: AppSec capacity limits, not negligence, drive vulnerable code shipping