Notifications
Clear all
Topic starter
02/08/2026 12:20 pm
TL;DR: Financial services security debt remains widespread, with 77% of organisations reporting unresolved application flaws and 30% of flaws still open two years after discovery, according to Veracode’s 2025 State of Software Security findings. The sector’s problem is not just defect discovery but remediation latency that compounds operational and regulatory exposure.
NHIMG editorial — based on content published by Veracode: The State of Application Security in Financial Services: Managing Security Debt
By the numbers:
- 77% of financial services organizations report security debt in their application portfolio.
- 63% of these organizations possess critical security debt.
- The flaw half-life in financial services is 276 days, almost a month slower than the cross-industry average of 252 days.
Questions worth separating out
Q: What breaks when security debt is not reduced in application security programmes?
A: Security debt turns isolated flaws into persistent exposure.
Q: Why do unresolved application flaws create extra risk in financial services?
A: Financial services organisations operate under high change velocity, regulatory scrutiny, and tightly coupled application estates.
Q: How do security teams know whether software trust is actually improving?
A: Look for shorter remediation cycles, fewer unowned dependencies, clearer approval paths, and stronger validation before release.
Practitioner guidance
- Implement closure-based remediation SLAs Track time-to-fix for high-risk application flaws as a named control objective, and tie overdue remediation to service ownership rather than scanner output.
- Prioritise open-source components in high-exposure paths Rank dependency risk by whether the component sits in authentication, token handling, secrets processing, or privileged workflows.
- Connect appsec findings to identity ownership Route flaws that affect login flows, session handling, service accounts, or secret storage to the teams that own those identity boundaries.
What's in the full report
Veracode's full report covers the operational detail this post intentionally leaves for the source:
- Cross-sliced benchmark data by financial services sub-sector, useful for comparing your programme against peers
- Detailed breakdowns of flaw half-life, security debt, and open-source remediation performance
- Contextual prioritisation guidance for turning SAST and ASPM output into measurable backlog reduction
- The report's sector-specific recommendations for development, security, and governance teams
👉 Read Veracode's analysis of security debt in financial services application security →
Security debt in financial services: what IAM and appsec teams need?
Explore further
02/08/2026 1:21 pm
Security debt is the governance failure hidden inside application security metrics. The article shows that defect discovery alone does not change risk when remediation cycles are too slow to close exposure. That pattern matters beyond appsec because identity controls fail in the same way when privileged access, service identities, or secrets stay active long after they should be retired. Practitioners should treat closure time as a governance control, not a delivery metric.
A question worth separating out:
Q: How should security teams reduce security debt without slowing delivery?
A: Use a remediation model that classifies risk, routes fixes into developer workflows, and validates closure before merge. The aim is not to make every vulnerability equally urgent. It is to focus engineering time on the flaws most likely to be exploited and to make remediation part of normal delivery, not an external interruption.
👉 Read our full editorial: Financial services security debt is slowing application risk reduction
