Topic starter
21/08/2026 4:50 pm
TL;DR: AppSec teams are drowning in a find-but-never-fix cycle, with 66% of organisations carrying more than 100,000 vulnerabilities and critical flaws averaging 252 days to remediate, according to Pixee and cited industry research. The core problem is not detection coverage but workflow capacity, and that makes automated remediation and developer-native controls the real constraint.
Editorial analysis by NHI Mgmt Group, based on content published by Pixee: “The Find but Never Fix Crisis: The Math Breaking AppSec Teams”.
By the numbers:
- Critical flaws now sit unpatched for an average of 252 days.
- The average application generates about 17 new vulnerabilities a month.
Key questions
Q: What breaks when AppSec teams can find vulnerabilities faster than they can fix them?
A: The control loop breaks.
Q: Why do critical vulnerabilities remain open for so long in modern appsec programmes?
A: They stay open because remediation is harder than detection in modular environments.
Q: What are the signs that an AppSec program is struggling to separate real risk from noise?
A: Common warning signs include too many findings scattered across disconnected tools, slow triage, and developers being overwhelmed by alerts that are not clearly prioritized.
Practitioner guidance
- Define remediation capacity targets Set a monthly closure target that is tied to incoming finding volume, release cadence, and criticality so backlog growth is visible as an operating metric.
- Automate triage before developers see tickets Use policy-based filtering and deduplication so only actionable, contextualised findings reach engineering queues, reducing avoidable noise.
- Move common fixes into developer workflows Push repeatable remediation patterns into IDEs, pull requests, or build pipelines so developers can resolve issues without switching tools or context.
Bottom line: AppSec backlogs grow when organisations can discover vulnerabilities faster than they can safely remediate them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:08 pm
Backlog growth is a governance failure, not a scanning failure. The article shows that many organisations can identify vulnerabilities but cannot convert those findings into timely code change. That means the weak point is the remediation workflow, not the detection stack. Practitioners should read this as a control design problem, not a tooling acquisition problem.
A question worth separating out:
A: Security teams should define the policy and acceptance criteria, while engineering teams own implementation and verification inside the codebase. The IDE plugin can accelerate remediation, but accountability still sits with the people approving code changes and the teams governing secure development standards. Clear ownership prevents automation from obscuring risk decisions.
👉 Read our full editorial: AppSec backlog growth is outpacing remediation capacity