Security Report · raw.githubusercontent.com

Orca 2026 AppSec Report Finds Critical Vulnerabilities in 78% of Organizations

Oct 20, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

Orca’s 2026 AppSec report, based on telemetry from over 1,000 production organizations, finds 78% run applications with critical vulnerabilities and 77% retain high or critical container flaws beyond 90 days.

Key points

Orca analyzed aggregated, anonymized production telemetry from more than 1,000 organizations collected between Q3 2025 and Q1 2026; findings reflect its platform customer sample.
The report found critical application vulnerabilities in 78% of organizations and known malicious packages in 11%; Log4Shell-affected dependencies remained present in 46%.
High or critical container vulnerabilities remained unpatched beyond 90 days in 77% of organizations, highlighting persistent remediation delays.
Valid secrets appeared in source repositories at 31% of organizations, while 30% retained recoverable secrets in Git history; AI/ML credentials were exposed at 43%.
Infrastructure-as-code findings included unencrypted storage at 84% of organizations, missing logging or monitoring at 80%, and publicly accessible administrative ports at 60%.
Repository controls were also inconsistent: 26% of organizations required no code review, and 25% lacked branch protection.
Recommendations include rotating exposed secrets, prioritizing reachable vulnerabilities, restricting CI/CD tokens, enforcing repository protections, and blocking high-risk infrastructure configurations before deployment.

Article Details

Publisher: Orca Security
Report Period: Q3 2025–Q1 2026
Scope: Production application security across dependencies, containers, secrets, CI/CD pipelines, infrastructure as code, and source repositories in multi-cloud environments.
Sample Size: More than 1,000 production organizations; aggregated, anonymized telemetry covering billions of production cloud assets.
Key Statistics: 78% of organizations had applications with critical vulnerable dependencies; the methodology describes organization-level percentages as weighted averages.
31% of organizations exposed valid, active secrets in repositories, while 43% exposed AI/ML credentials.
77% of organizations retained high or critical container vulnerabilities for more than 90 days.
11% of organizations had known malicious packages in production, including packages disclosed and removed from registries years earlier.
84% of organizations deployed unencrypted storage through infrastructure code, and 80% lacked logging or monitoring in IaC-managed environments.
Recommendations: Rotate exposed secrets across repositories, commit history, and CI/CD environments; deploy automated secret scanning with blocking controls.
Prioritize production-reachable, actively exploitable critical vulnerabilities; regularly rebuild approved container base images and scan registries and runtime workloads.
Restrict CI/CD token permissions, replace long-lived tokens with ephemeral credentials, pin GitHub Actions to commit SHAs, and enable audit logging.
Block known malicious dependencies, require lock files and integrity verification, and enforce branch protection, signed commits, maintainer MFA, and CODEOWNERS approval.
Integrate IaC scanning into CI/CD with blocking policies for public storage, open firewall rules, unencrypted resources, and overly permissive IAM roles.