Notifications
Clear all
Topic starter
02/08/2026 11:55 am
TL;DR: High-risk vulnerabilities increased 36% year over year, rising from 8.3% to 11.3% of all flaws found in Veracode's 2026 State of Software Security Report, as AI-assisted coding and expanding cloud-native attack surfaces push exploitable risk into code faster than traditional severity-led workflows can triage it. Severity alone is no longer a workable prioritisation model; exploitability-weighted remediation is becoming the control that matters most.
NHIMG editorial — based on content published by Veracode: The 36% Surge in High-Risk Vulnerabilities and What It Means for Your Business
By the numbers:
- The number of high-risk vulnerabilities has surged by 36% year-over-year.
- The proportion of these flaws grew from 8.3% to 11.3% of all vulnerabilities found.
Questions worth separating out
Q: How should security teams prioritise vulnerabilities when exploit timelines are shrinking?
A: Prioritisation should combine exploitability, reachability, internet exposure, identity proximity, and business criticality.
Q: Why do AI-assisted coding tools complicate security assurance for enterprise software?
A: They increase code output faster than teams can prove the output is safe.
Q: What do security teams get wrong about vulnerability management in complex environments?
A: They often treat the software flaw as the whole problem.
Practitioner guidance
- Move to exploitability-weighted triage Rank vulnerabilities by exploitability, business reach, and exposure path before you assign engineering effort.
- Gate AI-generated code before merge Add policy checks, secure code review, and dependency validation to the pull-request path so AI-assisted code cannot bypass human control points.
- Map vulnerable services to reachable identities Track which APIs, microservices, service accounts, and tokens can reach each high-risk flaw so remediation targets the paths an attacker would actually use.
What's in the full report
Veracode's full report covers the operational detail this post intentionally leaves for the source:
- The underlying methodology behind the 36% year-over-year increase in high-risk vulnerabilities, including how severity and exploitability were combined.
- More detail on how AI-assisted coding affected the vulnerability profile across the software estate.
- The report's guidance on how application security teams can shift backlog triage into a risk-based remediation workflow.
- Portfolio-level context on where high-risk flaws are concentrating across modern application architectures.
👉 Read Veracode's analysis of the 36% rise in high-risk vulnerabilities →
High-risk vulnerabilities and exploitability-weighted prioritisation?
Explore further
02/08/2026 1:03 pm
Exploitability is now the deciding variable in application risk. High-severity findings only become operationally meaningful when an attacker can actually use them. That shifts programme design away from simple count-based backlogs and toward exposure-aware triage, where the reachable flaw outranks the alarming but inert one. For application security leaders, the implication is that prioritisation quality is now a core control, not just a workflow preference.
A question worth separating out:
Q: When should organisations re-evaluate vulnerability prioritisation models?
A: Organisations should re-evaluate prioritisation whenever application complexity, API sprawl, or AI-assisted development increases faster than their remediation capacity. Those conditions create more exploitable exposure and make static scoring less useful. A newer model should account for attack path, asset criticality, and the identities that can reach the weakness.
👉 Read our full editorial: High-risk vulnerabilities are rising as exploitability outpaces scanning
