Notifications
Clear all
Topic starter
02/08/2026 12:23 pm
TL;DR: Software vulnerabilities used as an initial access point in breaches have risen 180% in Verizon’s latest DBIR, while 74% of organisations carry security debt and flaws often remain unfixed for over a year. Security debt is now a delivery constraint, not just a backlog item, because late discovery compounds both risk and rework.
NHIMG editorial — based on content published by Veracode: The Business Case for Investing in AppSec Tools
By the numbers:
- Our research shows that 74% of organizations carry security debt, with flaws remaining unfixed for over a year.
- Studies show this technology can cut fix times by over 50%.
Questions worth separating out
Q: How can teams prioritise AppSec findings more effectively?
A: Prioritise findings by exploitability, reachability, and privilege.
Q: Why do software vulnerabilities so often become identity and access problems?
A: Because modern applications rarely operate without credentials, tokens, certificates, and delegated service accounts.
Q: What breaks when AppSec is treated as a late-stage scan?
A: Late-stage scanning misses the point where insecure code, hardcoded secrets, and risky dependencies enter the system.
Practitioner guidance
- Map AppSec findings to business-critical assets Classify applications by revenue impact, exposure, and identity dependency so prioritisation reflects business risk rather than raw alert volume.
- Shift detection left into developer workflows Run SAST, SCA, and secret scanning in CI/CD and IDEs so developers see issues before merge rather than after release.
- Treat secrets as governed credentials Include API keys, tokens, certificates, and service account credentials in the same review, rotation, and offboarding processes used for privileged access.
What's in the full article
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step business-case structure for AppSec investment that security leaders can adapt for budget approvals.
- More detail on the ROI claims, including the Forrester TEI assumptions behind the 184% figure.
- A practical 5-step maturity roadmap for discovery, baseline setting, policy enforcement, remediation, and reporting.
- Veracode's framing of common objections such as false positives, developer slowdown, and budget constraints.
👉 Read Veracode's business case for investing in AppSec tools →
AppSec tool sprawl: what security and DevOps teams need to change?
Explore further
02/08/2026 1:23 pm
AppSec is now a governance problem, not only a code-quality problem. The article correctly frames tool investment as a business case, but the deeper issue is control fragmentation across source code, pipelines, dependencies, and runtime. When those layers are managed separately, risk ownership becomes blurred and remediation slows. The practical conclusion is that application security should be governed as a lifecycle control, not a collection of scans.
A question worth separating out:
Q: How can organisations measure whether AppSec controls are working?
A: They should look for fewer repeat vulnerabilities, lower false-positive burden, faster developer adoption, and measurable reduction in high-risk bug classes. A healthy AppSec programme changes the shape of risk, not just the number of alerts. If findings remain high but exposure does not fall, the control model is not scaling.
👉 Read our full editorial: AppSec tooling investment is now a delivery and risk decision
