Topic starter
16/01/2026 2:12 pm
TL;DR: 2025 AppSec is shifting toward runtime risk, according to Backslash Security, as static scanning, GenAI-generated code, CNAPP gaps, reachability analysis, and legacy-tool churn push teams to separate true exposure from noise. The identity implication is that application security is now inseparable from secrets, service credentials, and tool access moving through delivery pipelines.
Editorial analysis by NHI Mgmt Group, based on content published by Backslash Security: “The Top 5 AppSec Trends of 2025: Essential Insights”.
Key questions
Q: How can teams prioritise AppSec findings more effectively?
A: Prioritise findings by exploitability, reachability, and privilege.
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: What breaks when package scanning is not tied to runtime context?
A: Teams either miss risk because scans run too early, or they burn CI capacity on scans that cannot change the outcome.
Practitioner guidance
- Prioritise reachable findings Re-rank scanner output by whether the vulnerable code path is actually reachable in the application’s deployed architecture and data flow.
- Separate pre-release and runtime controls Use SAST, SCA, and secrets detection in the pipeline, then add runtime context where live execution evidence is needed for remediation decisions.
- Validate GenAI-assisted code Require stronger testing and dependency review for AI-generated code so copied insecure patterns and hidden third-party risk do not pass unchecked.
Bottom line: AppSec in 2025 is less about collecting more findings and more about deciding which findings are actually reachable in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 5:42 pm
Runtime risk is becoming the organising principle for AppSec. Static finding volume no longer tells practitioners what matters, because modern delivery pipelines generate more code, more dependencies, and more noise than review teams can sort manually. Reachability and execution context are now the better indicators of whether a weakness is operationally relevant. The implication is that AppSec programmes have to measure exploitability, not just presence.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How do SAST, SCA, secrets detection, and runtime analysis fit together?
A: They cover different stages of the delivery chain. SAST and SCA identify defects and dependency risk before release, secrets detection catches exposed credentials early, and runtime analysis confirms whether a weakness is actually reachable in production. Together they create a fuller risk picture than any one method alone.
👉 Read our full editorial: AppSec trends in 2025 are converging on runtime risk