Robotti’s 2026 AppSec Report Forecasts LLM, Supply-Chain and Cloud-Native Risks

Summary

Robotti’s 2026 AppSec report forecasts risks from LLM applications, software supply-chain compromise, cloud-native misconfiguration and APIs, and recommends secure-by-design governance, integrated testing and automated defenses.

Key points

The report highlights prompt injection, sensitive information disclosure, data and model poisoning, and excessive agency as key LLM application risks, with high-level mitigation approaches.
It says F5 confirmed persistent access by a nation-state actor in 2025 and theft of BIG-IP source code and information about undisclosed vulnerabilities.
The report says the Crimson Collective breached an internal Red Hat GitLab instance and exfiltrated 570GB from more than 28,000 repositories; the group claimed harvested credentials were used to pivot into customer infrastructure.
It identifies cloud-native misconfiguration, excessive permissions, CI/CD weaknesses and insecure secrets as significant application-security risks.
API risks discussed include broken object-level and function-level authorization, excessive data exposure, and resource abuse that can cause denial of service.
Recommendations include adopting application security posture management, embedding security controls in development pipelines, and using runtime protection and AI-assisted testing.

Article Details

Publisher: Robotti
Report Period: 2026
Scope: Application security risks and secure-by-design strategies, focusing on LLM applications, software supply chains, and cloud-native and API security.
Key Statistics: The report cites a forecast that 50% of C-level executives will have cybersecurity risk performance metrics tied to their employment contracts by 2026.
Gartner forecasts that 60% of organizations will use demonstrable cybersecurity risk posture as a key factor in selecting third-party partners and vendors by the end of 2025.
The report says more than 266,000 F5 BIG-IP instances were exposed online and that the incident threatened more than 600,000 internet-connected devices globally.
The Red Hat GitLab breach reportedly involved 570GB of data from more than 28,000 repositories.
The WEF reported that 35% of smaller organizations still had insufficient cyber resilience in 2024.
Recommendations: Train teams in AI/LLM security and implement specialized protections, especially for prompt injection and excessive agency.
Move from siloed scanning to unified Application Security Posture Management (ASPM) for code-to-cloud visibility.
Integrate AI into testing, triage, and response, and deploy Runtime Application Self Protection (RASP).
Embed secure-development metrics and compliance controls into Internal Development Platforms and verify them as code.