Datadog Report Finds Widespread Exploitable Vulnerabilities and Supply-Chain Risks

Summary

Datadog’s DevSecOps report analyzes tens of thousands of applications and finds widespread exploitable vulnerabilities, aging dependencies, and risky rapid software adoption. It recommends safeguards including dependency cooldowns and pinning GitHub Actions to commit SH

Key points

Datadog reports that 87% of organizations have at least one exploitable vulnerability, affecting 54% of services.
The median dependency is 773 days behind its latest major version; services deployed less than monthly have more outdated dependencies than those deployed daily.
The report found that 70% of organizations use third-party libraries within a day of release; 17% use public AMIs and 37% public Docker images within a day.
Only 3% of organizations pin every GitHub Marketplace action to a commit hash, while 91% do not pin any of their actions.
Datadog recommends full-length commit-SHA pinning for dependencies and GitHub Actions, and cooldown periods to reduce exposure to newly released malicious packages.
After contextual severity adjustments, only 13% of dependency vulnerabilities initially rated critical remained critical, reducing the number of critical alerts by more than 80%.

Article Details

Publisher: Datadog
Report Period: Data through January 2027; updated February 2027
Scope: Application vulnerabilities, dependency age, software adoption timing, public AMIs, Docker images, and GitHub Actions usage among organizations and services analyzed using Datadog data.
Sample Size: Tens of thousands of applications; exact count not disclosed.
Key Statistics: 87% of organizations had at least one exploitable vulnerability, affecting 54% of services.
70% of organizations used third-party libraries within one day of release; 1.5% of organizations using npm had used at least one identified malicious dependency in 2026.
91% of organizations using GitHub Actions never pinned the hash for any of their actions; only 3% pinned hashes for all marketplace actions.
Only 13% of critical dependency vulnerabilities remained critical after severity adjustment.
The median dependency was 773 days behind its latest major version, compared with 716 days in the previous year.
Recommendations: Pin dependency versions and GitHub Actions to full-length commit SHAs.
Use package-manager or Dependabot cooldowns to delay installation of newly released dependencies.
Use AWS Allowed AMIs when using community AMIs, and verify AMI owners.
Prefer trusted first-party container images; otherwise, consider a cooldown period and perform independent analysis.
Use regression testing when updating libraries, especially for major version upgrades.