Notifications
Clear all
Topic starter
02/08/2026 9:39 am
TL;DR: AppSec tools now surface more than 40,000 new CVEs in a year, while the average organisation faces 569,354 issues and 6,023 critical findings, according to OXSecurity. The real problem is not detection volume but the collapse of prioritisation, because teams cannot separate exploitable risk from noisy output.
NHIMG editorial — based on content published by OXSecurity: Application security detection without context is creating an AppSec death spiral
By the numbers:
- Last calendar year, 2024, showed us a record-breaking number of new vulnerabilities, more than 40,000, to illustrate.
- In 2024 alone, 15.32% of known CVEs were listed as “high” and “critical,” and this number represents a sharp increase over the previous year.
Questions worth separating out
Q: How should security teams prioritise AppSec findings when every scan produces thousands of alerts?
A: Start by filtering findings through reachability, exploitability, and business impact, not severity alone.
Q: Why do AppSec tools generate so much noise in mature environments?
A: Because many tools detect isolated technical flaws without understanding whether the weakness is exposed, reachable, or operationally important.
Q: What breaks when vulnerability management does not include cloud and identity context?
A: Teams lose the ability to distinguish an exploitable weakness from a theoretical one.
Practitioner guidance
- Build reachability-based triage rules Rank vulnerabilities only after validating whether the affected service is reachable from a public, partner, or internal access path.
- Correlate AppSec findings with IAM and cloud posture Join scanner output to cloud security posture data, service account inventories, and privilege mappings.
- Reduce alert volume before asking engineers to remediate Tune scanners to suppress duplicates, misclassified findings, and low-confidence alerts, then route only validated issues into developer workflows.
What's in the full article
OXSecurity's full article covers the operational detail this post intentionally leaves for the source:
- How the 30 plus disclosures and 10 plus CVEs are mapped to AppSec prioritisation failures
- Examples of business-context scoring that separate exploitable issues from low-value noise
- Step-by-step guidance for connecting code, build, cloud, and runtime signals
- Developer workflow patterns that reduce alert fatigue without suppressing genuine risk
👉 Read OXSecurity's analysis of why AppSec detection without context is failing teams →
AppSec alert overload: what security teams need to fix now?
Explore further
02/08/2026 12:34 pm
Detection without context is not a control, it is a backlog generator. AppSec programmes that optimise for finding more issues without improving prioritisation create operational paralysis. The governance failure is not a lack of telemetry, but a lack of decision logic that ranks findings by reachability, privilege, and business consequence. In practice, teams need fewer undifferentiated alerts and more defensible triage criteria.
A question worth separating out:
Q: What should organisations do when engineers stop trusting AppSec alerts?
A: Treat it as a programme failure, not a developer attitude problem. Recalibrate scanner rules, remove low-value duplicates, and show why each finding matters in the application’s real environment. If teams can see the path from issue to impact, they are far more likely to act on it.
👉 Read our full editorial: AppSec detection without context is creating a prioritisation crisis
