Topic starter
02/08/2026 11:37 am
TL;DR: AppSec budgets are rising while tool sprawl, manual triage, and late-stage remediation still drain time and money, according to OXSecurity. The practical shift is from compliance-led spending to risk-based, automated secure-by-design controls that reduce rework and improve software security ROI.
Editorial analysis by NHI Mgmt Group, based on content published by OXSecurity: “Shift Left, Budget Right: Getting the Most From Your AppSec Budget”.
By the numbers:
- Security as a percentage of IT spending increased from 8.6% in 2020 to 13.2% in 2024.
- IDC research indicates that 50% of software developers spend 19% of their time each week on security tasks.
Key questions
Q: How should teams invest in AppSec when budgets are rising but risk remains fragmented?
A: Prioritise spend on controls that reduce exposure earlier in the SDLC and remove duplicate work from the operating model.
Q: Why do fragmented AppSec tools create more risk than just operational noise?
A: Because fragmentation delays triage, obscures ownership, and makes it harder to prove whether a control is working.
Q: What are the signs that AppSec spending is not improving security outcomes?
A: Long remediation queues, repeated findings across releases, heavy manual triage, and developers spending significant time on security tasks are all warning signs.
Practitioner guidance
- Define AppSec spend by risk tier Map budget lines to the asset classes, threat scenarios, and compliance obligations they actually protect.
- Consolidate overlapping AppSec tooling Reduce duplicate scanners, redundant dashboards, and separate triage queues that force analysts to reconcile the same vulnerability in multiple systems.
- Move security checks into CI/CD gates Make design, build, and release controls fail early for critical issues so remediation happens before production exposure and release delay multiply the cost.
Bottom line: AppSec budget growth does not create better security on its own if teams keep funding fragmented tools and late-stage remediation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:50 pm
AppSec ROI fails when organisations buy more inspection than enforcement. The article's central point is that budget growth does not automatically produce risk reduction if teams keep layering scanners, dashboards, and specialist tools without changing where decisions are made. In practice, the expensive part of AppSec is often the human reconciliation layer, not the tooling itself. The practitioner conclusion is simple: budget should follow a control model, not a catalogue.
A question worth separating out:
Q: Should organisations prioritise secure-by-design over late-stage compliance fixes?
A: Yes, when the goal is to reduce cost and risk at the same time. Earlier controls usually prevent more rework, are easier to enforce, and create better evidence for governance than compensating for defects after deployment.
👉 Read our full editorial: AppSec budget growth is shifting toward secure-by-design ROI