Topic starter
02/08/2026 11:55 am
TL;DR: High-risk vulnerabilities increased 36% year over year, rising from 8.3% to 11.3% of all flaws found in Veracode's 2026 State of Software Security Report, as AI-assisted coding and expanding cloud-native attack surfaces push exploitable risk into code faster than traditional severity-led workflows can triage it. Severity alone is no longer a workable prioritisation model; exploitability-weighted remediation is becoming the control that matters most.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “The 36% Surge in High-Risk Vulnerabilities: What It Means for Your Business”.
By the numbers:
- High-risk vulnerabilities surged 36% year over year in Veracode's 2026 State of Software Security Report.
- Their share of all vulnerabilities rose from 8.3% to 11.3% in the report.
Key questions
Q: What breaks when security teams rely on vulnerability severity instead of exploitability?
A: Prioritisation breaks first.
Q: Why do AI-assisted development pipelines increase the need for stronger security review?
A: AI-assisted development can accelerate code production faster than traditional review and testing processes can absorb.
Q: How do you know if vulnerability triage automation is actually working?
A: Look for shorter time from discovery to assignment, fewer duplicate reviews, and a smaller backlog of stale findings.
Practitioner guidance
- Adopt exploitability-weighted triage Build remediation queues around exploitability, exposure, and impact instead of CVSS severity alone, so urgent flaws surface ahead of theoretical ones.
- Insert validation gates for AI-generated code Require review, testing, and security checks where AI-assisted code enters the pipeline, especially for patterns that repeatedly produce high-severity flaws.
- Map reachable attack paths first Identify the APIs, microservices, and cloud-native trust boundaries that make a defect realistically exploitable before assigning remediation priority.
Bottom line: High-risk vulnerabilities are becoming more concentrated, which makes backlog management a governance problem as much as a technical one.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Exploitability, not severity, is becoming the real triage primitive: teams that still sort queues by criticality alone are optimising for the wrong signal. High-severity defects can be noisy, but exploitability tells you what can become an incident under current exposure conditions. The practical conclusion is simple: security backlogs need a live risk lens, not a static scoring list.
A question worth separating out:
Q: What should organisations do when cloud-native architecture expands the attack surface?
A: They should focus first on the services, APIs, and credentials that create the shortest path from flaw to impact. In distributed systems, the right question is not how many vulnerabilities exist, but which ones can be reached through a live trust path that an attacker can actually use.
👉 Read our full editorial: High-risk vulnerabilities are rising as exploitability outpaces scanning