Security tool adoption gap: what developers actually ignore

TL;DR: Developer security tool failure is usually an adoption problem, not a detection problem, according to Appknox: noisy alerts, workflow friction, weak exploitability context, and unclear ownership turn security findings into shelfware, while 81% of teams still knowingly ship vulnerable code. The practical lesson is that remediation signal, workflow fit, and named accountability matter more than more scans.

NHIMG editorial — based on content published by Appknox: Security Tools Don't Fail. Adoption Does: Why Developers Ignore Them

By the numbers:

• 81% of development teams knowingly ship code with vulnerabilities, according to Appknox.
• 95–98% of AppSec alerts don't require action, according to OX Security's 2025 benchmark.
• 50% of developers report losing 10 or more hours per week to organizational inefficiencies, according to Atlassian.

Questions worth separating out

Q: How should security teams make offensive security findings actionable?

A: They should connect each finding to ownership, context, remediation tracking, and retesting.

Q: Why do developers ignore security tools even when they know a risk is real?

A: Developers ignore tools when the cost of acting is higher than the cost of deferring.

Q: What breaks when security findings have no named owner?

A: Findings without a named owner become permanent backlog.

Practitioner guidance

• Measure actionability, not scan volume Track the percentage of findings that result in a ticket, a code change, or a revoked entitlement within the normal delivery workflow.
• Move remediation into the engineer's workflow Surface findings inside the IDE, pull request, or backlog system the team already uses, and reduce portal hopping wherever possible.
• Prioritise exploitable paths over theoretical severity Use exploitability criteria to rank issues that are actually reachable in your environment, including active secrets, live tokens, and permissions that can be abused from current trust boundaries.

What's in the full article

Appknox's full blog covers the operational detail this post intentionally leaves for the source:

• The full breakdown of six adoption failure modes, including alert fatigue, context switching, and ownership gaps.
• The mobile security section on runtime conditions, on-device token risk, and why static tools miss mobile attack paths.
• The developer workflow examples showing how findings get buried in portals instead of being fixed in the IDE or backlog.
• The practical adoption model for measuring whether findings are actually acted on, not just generated.

👉 Read Appknox's analysis of why developers ignore security tools →

Security tool adoption gap: what developers actually ignore?

Explore further

View Full Forum →  |  NHI Foundation Course →