Security Report · raw.githubusercontent.com

Contrast Security Report Highlights AppSec Remediation Gaps and AI Scanner Inconsistency

Oct 20, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

Contrast Security’s AppSec Overflow 2026 report finds applications average 22 high or critical vulnerabilities and 42 viable exploit attempts monthly. It also reports slow remediation and inconsistent AI-scanner findings.

Key points

The report draws on anonymized runtime telemetry from production applications and APIs, examining attack activity over the preceding 12 months.
Contrast reports an average of 11,382 attacks per application monthly, including 42 viable attempts that it says reached and triggered actual vulnerabilities; these figures do not establish successful compromise.
Untrusted deserialization led observed viable attack techniques, followed by path traversal and method tampering. SQL injection ranked among the top five techniques in every industry vertical studied.
Monitored applications averaged 22 high or critical vulnerabilities in custom code. Teams fixed 3.4 vulnerabilities per application monthly, while critical custom-code flaws took an average of 92 days to remediate.
Of the third-party vulnerability instances observed in production, 54% involved CVEs published more than a year earlier.
In Contrast’s AI-scanner testing, three scanners agreed on only 5% of findings; one scanner reproduced just 17% of its findings across repeated runs.
The report recommends combining CVSS, EPSS, and known-exploitation information with application exposure and runtime evidence, rather than relying on generic vulnerability scores alone.

Article Details

Publisher: Contrast Security
Report Period: Last 12 months; a separate prioritization analysis covers a 30-day window in early 2026. Exact dates are not disclosed.
Scope: Application-layer attacks, production vulnerabilities, remediation, AI scanner consistency, and risk prioritization using Contrast runtime telemetry.
Sample Size: Thousands of production applications and APIs worldwide; exact analyzed population not disclosed. Scanner consistency testing involved three scanners.
Key Statistics: Contrast reports an average of 11,382 attacks per application per month, including 42 viable exploitation attempts confirmed through runtime observation to have reached and triggered a vulnerability.
The average monitored application carries 22 high- or critical-severity vulnerabilities in custom code, while teams remediate an average of 3.4 vulnerabilities per application per month.
Critical application vulnerabilities take an average of 92 days to remediate.
54% of observed third-party CVE instances in production applications correspond to CVEs published more than one year earlier.
In Contrast's scanner testing, three scanners analyzing the same codebase agreed on only 5% of findings; one scanner reproduced only 17% of its findings across three runs.
Recommendations: Combine CVSS, EPSS, and KEV signals with runtime exploitability, application exposure, business criticality, and observed attack activity when prioritizing remediation.
Monitor production application behavior and deploy runtime controls capable of blocking exploitation while remediation is pending.
Give applications and APIs receiving the highest attack volumes additional scrutiny, and prioritize vulnerabilities that enable persistent access or code execution.
Avoid deserializing untrusted input, use safer serialization formats, and keep serialization-related libraries and frameworks updated.
Validate file path inputs, allow-list permitted files and directories, and restrict application file system privileges.