Notifications
Clear all
Topic starter
02/08/2026 11:33 am
TL;DR: More than 47 million scans, over 229 million flaws identified, and 148 million fixes over 20 years underscore the scale of the problem, according to Veracode. Veracode’s 2026 State of Software Security report shows 82% of organisations still carry security debt and remediation is lagging, while the practical issue is not scan volume but whether governance, verification, and fix workflows can keep pace with AI-assisted development.
NHIMG editorial — based on content published by Veracode: Veracode’s 20th Anniversary: Two Decades of Data Powering the Future of Software Security
By the numbers:
- Veracode has run more than 47 million scans, identified over 229 million flaws, and helped teams fix 148 million of them over two decades.
- 82% of organisations carry security debt, vulnerabilities left unresolved for more than a year.
- 60% face critical security debt, a 20% rise from the prior year.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do third-party dependencies create such persistent security debt?
A: Third-party dependencies create persistent security debt because organisations often discover flaws faster than they can replace, patch, or retest them.
Q: What breaks when software security stops at scanning?
A: What breaks is remediation prioritisation.
Practitioner guidance
- Implement provenance checks for AI-generated code Require evidence of source, transformation, and validation for generated code before merge or release.
- Shift AppSec triage to exploitability-first prioritisation Use severity, exposure, reachability, and asset criticality to decide what gets fixed first.
- Enforce policy in CI/CD pipelines Move validation gates into the pipeline so insecure builds are blocked before production deployment.
What's in the full article
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- How Veracode applies scan intelligence across static analysis, dynamic analysis, and software composition analysis in the product workflow
- Examples of AI-powered remediation guidance inside the IDE for developers who need fix-level detail
- The way Veracode frames continuous verification and attestation for boards, regulators, and cyber insurers
- The platform-specific explanation of container security and AI-driven protection in the delivery pipeline
👉 Read Veracode's 20th anniversary analysis of software security data and AI-assisted development →
AI-assisted code security: are governance controls keeping up?
Explore further
02/08/2026 12:47 pm
AI-assisted code governance debt is the new security backlog. The issue is not simply that more code is being created. It is that governance processes still assume human-paced review cycles while generation, dependency updates, and deployment all accelerate. That creates a structural mismatch between how software is produced and how risk is controlled. Practitioners should treat AI-assisted development as a governance design problem, not just a scanning problem.
A question worth separating out:
Q: What should organisations do first when exploit discovery is moving faster than remediation?
A: Start by ranking exposure paths, not by trying to eliminate every vulnerability equally. Define the systems that matter most, reduce standing privilege around them, and validate segmentation against real traffic. Then tie incident response to isolation and continuity of operations, because speed of containment now matters more than the speed of patch completion.
👉 Read our full editorial: AI-assisted code security needs governance that keeps pace with scale
