Topic starter
20/08/2026 6:09 pm
TL;DR: Deadline pressure, late discovery, and remediation capacity gaps drive the behavior, with 81% of organizations knowingly shipping vulnerable code, according to Pixee citing Checkmarx survey data. The lesson for IAM and security programmes is that controls fail when teams cannot convert findings into timely fixes, especially as AI and secrets exposure increase the volume of work.
Editorial analysis by NHI Mgmt Group, based on content published by Pixee: “81% Ship Vulnerable Code. The Problem Isn't Negligence—It's Capacity.”.
Key questions
Q: What breaks when AppSec teams can find vulnerabilities faster than they can fix them?
A: The control loop breaks.
Q: Why does deadline pressure increase the risk of shipping vulnerable code?
A: Deadline pressure changes the trade-off from ideal remediation to acceptable loss.
Q: How do security teams know whether Teams remediation is working?
A: They should measure dwell time, removal latency, and the percentage of malicious messages removed before any user interaction.
Practitioner guidance
- Define remediation capacity as a control metric Track how many findings engineering teams can actually close per sprint or release cycle, then compare that against new vulnerability intake to expose the real backlog pressure.
- Prioritise by deployment context, not severity alone Rank vulnerabilities by where they sit in the architecture, whether compensating controls exist, and how much access or data exposure they create in practice.
- Automate the lowest-friction fixes first Use automation for dependency updates, safe patching, and validation so that scarce engineering time is reserved for the cases that truly need human judgment.
Bottom line: The article argues that vulnerable-code shipping is mainly a capacity problem, where remediation work cannot keep pace with the volume of findings.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:45 pm
Capacity, not negligence, is the real failure mode: organisations ship vulnerable code when remediation demand exceeds engineering throughput. The article is right to push back on moralised explanations, because shame does not change backlog physics. For security leaders, the implication is clear: if the fix queue cannot be cleared, the control has failed before release.
A question worth separating out:
Q: Should organisations automate remediation or keep it manual?
A: Start with automated triage and low-risk fixes, then reserve manual review for high-impact exceptions. Automation is most useful when it removes unused access, highlights policy violations, and shortens time to action, but humans still need to decide on edge cases where business context changes the risk.
👉 Read our full editorial: AppSec capacity limits, not negligence, drive vulnerable code shipping