Veracode 2026 Report Finds Rising Security Debt Despite Faster Vulnerability Fixes
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Veracode’s 2026 software security report finds 82% of organizations carry vulnerabilities unresolved for over a year. High-risk flaws rose from 8.3% to 11.3%, while remediation half-life improved only slightly to 243 days.
Key points
- The analysis covers 1.6 million unique applications and 141.3 million raw findings from testing through Veracode’s platform; invalid mass-closure events were excluded.
- Organizations carrying security debt—known vulnerabilities unresolved for more than a year—increased from 74% to 82%; those carrying critical debt rose from 50% to 60%.
- Flaws rated both highly severe and highly exploitable increased from 8.3% to 11.3%, a 36% relative rise.
- Overall application flaw prevalence fell from 80% to 78%, but remediation half-life improved only from 252 to 243 days.
- Third-party code accounted for roughly 66% of critical security debt. Third-party flaw remediation half-life was 358 days, despite open-source vulnerability prevalence falling from 70% to 62% of applications.
- The report recommends prioritizing severe, exploitable vulnerabilities in business-critical applications, strengthening dependency management and using human-reviewed automated fixes.
- AI’s impact was not explicitly measured; the report discusses AI-related risks and remediation opportunities without establishing a causal link to the observed trends.
Article Details
- Publisher
- Veracode
- Report Period
- 2026 report, compared with the 2025 baseline; collection dates not disclosed
- Scope
- Application security findings from static analysis, dynamic analysis, software composition analysis, and manual penetration testing through Veracode’s platform. Invalid mass-closure events were excluded from persistence and remediation analyses.
- Sample Size
- 1.6 million unique applications and 141.3 million raw findings: 115.6 million static, 3.6 million dynamic, and 22.1 million SCA findings.
- Key Statistics
- Security debt—known vulnerabilities unresolved for more than one year—affected 82% of organizations, versus 74% in 2025; critical security debt affected 60%, versus 50%.
- Vulnerabilities with both high severity and high exploitability increased from 8.3% to 11.3%, a 36% relative increase.
- Overall flaw remediation half-life decreased from 252 to 243 days; approximately 42% of flaws remained unresolved beyond one year.
- Third-party code accounted for approximately 66% of critical security debt. Third-party flaw remediation half-life was 358 days, 115 days longer than the overall half-life.
- Applications with open-source vulnerabilities decreased from 70% to 62%; overall application flaw prevalence decreased from 80% to 78%.
- Recommendations
- Prioritize highly exploitable, high-severity vulnerabilities in business-critical applications, incorporating runtime and business context.
- Pilot AI-assisted remediation for repetitive vulnerabilities with human review, and reserve development capacity for security debt reduction.
- Implement package manager firewalls, security-focused dependency reviews, frequent library updates, and proactive dependency scanning integrated into CI/CD pipelines.
- Integrate automated fix suggestions into development workflows and establish fix-before-close policies for high-risk vulnerabilities in new code.
- Make security debt a board-level KPI and tie security outcomes to development team objectives and performance reviews.
People
David SeverskiCyentia Institute contributor credited with data analysis and statistical modeling supporting the report.Joe AriganelloCredited with authoring and shaping the report narrative.Natalie TischlerCredited with authoring and shaping the report narrative.Wade BakerCyentia Institute contributor credited with data analysis and statistical modeling supporting the report.