Notifications
Clear all
Topic starter
20/08/2026 6:04 pm
TL;DR: The real story from 2025 is not any single breach or CVE count, but a structural mismatch between disclosure velocity, skills capacity, and attack automation, with 48,185 CVEs and 30-day weaponization timelines forcing new operating models, according to Pixee. The practical implication is that exploitability-based prioritization, automated remediation, and tighter control over software supply chain paths now matter more than traditional reactive patch cycles.
NHIMG editorial — based on content published by Pixee: What Security Leaders Learned in 2025 and What They're Watching in 2026
By the numbers:
- 30% of breaches now trace to third-party compromise.
- 88% of organisations experienced incidents due to skills gaps, not headcount.
Questions worth separating out
Q: What breaks when vulnerability discovery is faster than patch cycles?
A: Patch-centric programmes break because they assume security teams have days or weeks to assess, approve, and deploy fixes.
Q: Why do developer credentials create supply-chain risk beyond repository access?
A: Because those credentials often control release, signing, and marketplace distribution, not just source-code access.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Prioritise exploitability over severity Rebuild remediation queues so that internet exposure, active exploitation, and privilege adjacency outrank static CVSS alone, then automate the first response tier for the highest-risk items.
- Map CI/CD credentials as non-human identities Inventory package registry tokens, build secrets, deployment keys, and signing credentials as governed identities with owners, scope limits, and explicit revocation paths.
- Add provenance checks to AI-generated code Require traceability from generated snippet to repository, owner, review state, and deployment target before AI-assisted changes can reach production.
What's in the full article
Pixee's full analysis covers the operational detail this post intentionally leaves for the source:
- The full practitioner breakdown of 2025 CVE trends and the specific categories driving backlog growth
- Detailed commentary on the security skills gap, including how practitioners framed staffing and automation tradeoffs
- The supply chain incident references and source material behind the Trust Wallet and React2Shell examples
- Pixee's cited expert commentary on AI-coded breaches, threat velocity, and operational response priorities
👉 Read Pixee's analysis of 2025 security lessons for AppSec and AI risk →
AppSec in 2026: what changes when patching cannot keep up?
Explore further
20/08/2026 6:40 pm
Exploitability has replaced severity as the deciding variable in AppSec governance. Severity still matters for triage, but attackers do not wait for annual planning cycles, and the article’s data shows that exploitation timelines are now shorter than many remediation cycles. That means the governance question is no longer whether a flaw is serious in theory, but whether it is reachable, weaponisable, and already being operationalised. Practitioners should treat exploitability as the primary control lens.
A question worth separating out:
Q: How should security teams respond when exploit timelines compress to days?
A: They should shift from annual or quarterly response assumptions to continuous prioritisation, automated containment, and rapid credential rotation for exposed systems. When attackers weaponise flaws quickly, the critical metric becomes exposure duration. Teams need fast revocation paths, not just better alerts, because response speed is now a security control.
👉 Read our full editorial: 2026 appsec risk shifts from patch velocity to automation
