Checkmarx Survey Finds Application Security Gaps as AI Coding Expands
Summary
Checkmarx’s survey of 1,519 security and development professionals found 98% reported breaches linked to vulnerable applications. The report highlights knowingly shipped vulnerabilities, limited security-tool adoption and gaps in AI coding governance.
Key points
- Censuswide surveyed 514 CISOs, 501 AppSec managers and 504 software developers across nine countries during April 7–29, 2025.
- 98% of respondents reported at least one breach caused by a vulnerable application their organization developed in the preceding 12 months; 27% reported four or more, versus 16% in 2024.
- 81% said their organization, or one they knew, sometimes or often deployed code with known vulnerabilities, up from 66% in 2024.
- Reasons cited for releasing vulnerable code included meeting deadlines (38%), planning a later fix (36%) and hoping the vulnerability would not be discovered (33%).
- Only 18% reported an approved list of AI coding tools; 20% said such tools were prohibited but knew or assumed individuals used them without permission.
- Among CISOs and AppSec managers, reported adoption remained below half for DAST (47%), infrastructure-as-code security (48%), SAST (48%) and software composition analysis (46%).
- The report recommends approved AI tools, code-provenance controls, automated security checks in development workflows and shared security metrics across development and security teams.
Article Details
- Publisher
- Checkmarx
- Report Period
- 2025-04-07 to 2025-04-29
- Scope
- Global survey of application security practices, vulnerable-code deployment, AI governance, tooling adoption, and security-development collaboration, with comparisons to earlier survey waves.
- Sample Size
- 2025 wave: 1,519 respondents aged 18+, comprising 514 CISOs, 501 AppSec Managers, and 504 software developers; research conducted by Censuswide.
- Key Statistics
- 98% of 2025 respondents reported at least one breach in the preceding 12 months directly resulting from a vulnerable application their organization developed, compared with 91% in 2024.
- 27% reported four or more breaches in 2025, compared with 16% in 2024.
- 81% said their organization, or an organization they know, often or sometimes deployed code with known vulnerabilities into production, compared with 66% in 2024.
- Among CISOs and AppSec Managers surveyed in 2025, reported adoption was 47% for DAST, 48% for IaC security, 48% for SAST, and 46% for SCA.
- 18% of respondents reported an approved list of AI code-generation tools; 20% said such tools were prohibited but knew or assumed individuals were using them without permission.
- Recommendations
- Establish approved AI tool lists, audit trails, code-provenance tracking, and mandatory security scanning for AI-generated code.
- Embed security feedback and remediation guidance directly into IDEs, pull requests, and CI/CD pipelines.
- Implement hard stops for critical vulnerabilities in CI/CD while providing fast remediation paths.
- Correlate findings across code, dependencies, infrastructure, and APIs through integrated security platforms and shared dashboards.
- Include security validation in delivery success criteria, align incentives across development and security, and provide secure-code training.
Vendors
Industries
Education37% of respondents in the Insurance sector say they have experienced a breach three times in the last 12 months, while just 3% of those in Education say the same.Insurance37% of respondents in the Insurance sector say they have experienced a breach three times in the last 12 months, while just 3% of those in Education say the same.