Notifications
Clear all
Topic starter
02/08/2026 11:57 am
TL;DR: Security debt reached 82% of organisations in 2026, while critical security debt climbed to 60% and nearly half of applications now carry unresolved flaws, according to Veracode's 2026 State of Software Security Report. The evidence points to a capacity and prioritisation problem, not a simple tooling gap, and that same logic applies when identity and access debt accumulates across application and NHI programmes.
NHIMG editorial — based on content published by Veracode: The Security Debt Crisis, Why 82% of Organizations Are Struggling
By the numbers:
- Security debt has climbed from 71% of organisations in 2024 to 82% in 2026, an 11% year-over-year increase.
- Critical security debt rose from 46% of organisations in 2024 to 60% in 2026, a 20% year-over-year increase.
- Nearly half 49% of all applications now carry security debt.
Questions worth separating out
Q: What breaks when security debt keeps growing faster than remediation capacity?
A: When security debt outpaces remediation, organisations stop fixing what is most dangerous and start deferring what is easiest to ignore.
A: When a vulnerability is publicly exploited, internet-facing, or connected to high-value identity paths, it should move ahead of routine backlog work.
Q: What do security teams get wrong about AI-powered remediation for NHIs?
A: Teams often assume that faster remediation is automatically safer.
Practitioner guidance
- Implement exploitability-weighted triage Rank remediation by exploitability, asset criticality, and exposure rather than by CVSS alone.
- Enforce fix-before-close gates Block high-risk findings from merging unless a documented exception is approved by the accountable owner.
- Track ageing exposure separately from total findings Report how many vulnerabilities, secrets, or privileged accounts have remained unresolved for more than one release cycle.
What's in the full report
Veracode's full analysis covers the operational detail this post intentionally leaves for the source:
- The full 2026 State of Software Security report breakdown by year, including the underlying trend data behind the 82% security debt figure.
- The report's discussion of remediation strategy, including how the vendor frames AI-assisted prioritisation and code-fix workflows.
- The source article's explanation of how SAST, DAST, and SCA discovery can create more backlog even as visibility improves.
- The article's deeper guidance on setting fix-before-close policies inside CI/CD pipelines and release gating.
👉 Read Veracode's analysis of the 2026 security debt crisis and remediation priorities →
Security debt in CI/CD pipelines: what security teams need to fix now?
Explore further
02/08/2026 1:04 pm
Security debt is an identity governance problem as soon as backlog affects secrets, service accounts, and privileged access. The same operational failure that leaves software vulnerabilities unresolved also leaves credentials unrotated, access reviews incomplete, and ownership unclear. Once teams cannot close findings fast enough, the governance question shifts from discovery to containment. Practitioners should treat unresolved identity backlog as a form of standing exposure debt.
A question worth separating out:
Q: How do organisations know if fix-before-close is actually working?
A: It is working when high-risk findings stop entering production, ageing risk declines, and exception volumes remain tightly controlled. The best signal is not fewer alerts alone. It is shorter time-to-remediate for critical issues and fewer unresolved items older than one release cycle.
👉 Read our full editorial: Security debt is outpacing remediation in modern software development
