Topic starter
02/08/2026 11:33 am
TL;DR: More than 47 million scans, over 229 million flaws identified, and 148 million fixes over 20 years underscore the scale of the problem, according to Veracode. Veracode’s 2026 State of Software Security report shows 82% of organisations still carry security debt and remediation is lagging, while the practical issue is not scan volume but whether governance, verification, and fix workflows can keep pace with AI-assisted development.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “Veracode’s 20th Anniversary: Two Decades of Data Powering the Future of Software Security”.
By the numbers:
- Veracode says it has run more than 47 million scans over 20 years.
- Veracode says it has identified over 229 million flaws.
- Veracode says it has helped teams fix 148 million flaws.
Key questions
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Q: Why does remediation lag become a security governance problem?
A: Remediation lag turns vulnerability management into risk accumulation.
Q: What are the signs that software trust controls are failing?
A: Common warning signs include growing approval backlogs, repeated exceptions to release policy, unclear provenance for production artefacts, and security teams relying on spot checks instead of continuous evidence.
Practitioner guidance
- Enforce release gates for AI-generated code Require every AI-assisted change to pass policy-based validation before merge or deployment, including provenance checks and explicit approval for exceptions.
- Track remediation ageing as a governance metric Measure how long high-risk flaws remain open, especially in third-party code, and escalate items that exceed your acceptable risk window.
- Bind production approval to continuous verification Revalidate approved artifacts, container images, and application changes after build and before release so runtime state matches what was tested.
Bottom line: AI-assisted development increases software throughput faster than many governance models can verify and approve changes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:47 pm
AI-assisted code security is now an assurance problem, not only a detection problem. The article’s central lesson is that scale has moved the weak point from discovery to proof. Organisations can scan more code, but if they cannot enforce what enters production, they have not solved the governance problem. The practical conclusion is that software security must be measured by controlled release, not alert volume.
A question worth separating out:
Q: What happens when release approvals do not cover AI-assisted changes?
A: AI-assisted changes can move into production faster than review and remediation can keep up, which increases the chance that vulnerable code, unsafe dependencies, or undocumented logic becomes part of the live environment. The practical consequence is a larger and longer-lived attack surface.
👉 Read our full editorial: AI-assisted code security needs governance that keeps pace with scale