Notifications
Clear all
Topic starter
02/08/2026 11:36 am
TL;DR: Application security debt now affects 82% of organisations, critical debt has reached 60%, and AI-powered development is accelerating the flow of vulnerable code into production, according to Veracode. The old model of periodic scanning and severity-only triage is no longer sufficient; continuous assessment, risk-based prioritisation, and automated quality gates are becoming the practical baseline.
NHIMG editorial — based on content published by Veracode: How to Manage Risks Within Your Applications
By the numbers:
- security debt now affects 82% of organizations
- critical security debt has surged to impact 60% of organizations
- high-risk vulnerabilities, the ones attackers are actively weaponizing, have risen 36% year over year
Questions worth separating out
Q: How should security teams manage application risk in fast-moving development environments?
A: Security teams should move from periodic review to continuous assessment inside the delivery pipeline.
Q: Why does AI-assisted development increase application identity risk?
A: Because many applications implement identity controls in code, and AI tools can reproduce insecure login, token, and access patterns at scale.
Q: What breaks when organisations rely on severity scores alone for application triage?
A: Severity-only triage produces alert overload and does not separate theoretical issues from flaws that attackers can actually reach and weaponise.
Practitioner guidance
- Shift to continuous application risk assessment Embed SAST, SCA, DAST, and container checks directly into CI/CD so each commit, dependency update, and build produces an enforceable security signal rather than a delayed report.
- Prioritise by exploitability, exposure, and business impact Use a three-part triage model to isolate flaws that are reachable, known to be weaponised, and tied to critical applications or identity services, then route those issues first.
- Apply security gates to AI-generated code Require security guidance and automated scanning at the point where AI-produced code enters the pipeline, especially for authentication, API, and service-account handling logic.
What's in the full article
Veracode's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for embedding SAST, SCA, DAST, and container checks into CI/CD pipelines
- Practical prioritisation criteria for separating exploitable flaws from noise in large application portfolios
- Application Security Posture Management reporting concepts that turn findings into board-ready risk metrics
- Specific remediation workflow examples for AI-generated code and security debt reduction
👉 Read Veracode's guide on managing application risk within modern development pipelines →
Application risk management is changing fast. What should teams do now?
Explore further
02/08/2026 12:49 pm
Application risk management has become a continuous governance discipline, not a scanning exercise. The article reflects a broader shift in how software exposure must be controlled: by the time a periodic report is generated, the risk picture has already moved. This matters because application controls increasingly sit upstream of identity, secrets, and workload access paths. Practitioner conclusion: teams need continuous enforcement, not retrospective documentation.
A question worth separating out:
Q: Which frameworks best fit modern application risk management programmes?
A: NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5 Security and Privacy Controls, and CIS Controls v8 all align well when the goal is continuous assessment, access control, logging, and secure development. Teams should map controls to the delivery pipeline and evidence where each risk signal is enforced.
👉 Read our full editorial: Application risk is collapsing under AI-driven development velocity
