AI AppSec tools agree on just 5% of security findings
Software vulnerabilities are turning into exploits within hours, and application security teams carry patch backlogs that go back years.
Top types of viable application attacks (Source: Contrast Security)
Contrast Security’s AppSec Overflow 2026 report draws on telemetry collected from inside hundreds of thousands of production applications and APIs.
Attacks land every few minutes
Adversaries touch the average application once every four minutes. Most of that traffic is automated reconnaissance, scanners mapping out weaknesses and cataloging services.
A smaller slice shows exploit payloads and attempts to manipulate application behavior. Contrast recorded 42 confirmed, viable exploit attempts per application every month, meaning the vulnerability was not just probed, it was triggered.
Untrusted deserialization led the field among these confirmed exploits, followed by path traversal and method tampering. SQL injection showed up in the top five attack techniques for every industry vertical Contrast tracked, from finance to healthcare to manufacturing.
A company with a few dozen employees runs a couple dozen applications and APIs on average. That number climbs with headcount, and organizations with more than 5,000 employees run several hundred applications and APIs on average.
Patch backlogs stretch past a year
Applications monitored by Contrast carry an average of 106 vulnerability findings in code written in-house, including 22 rated high or critical severity.
Development and security teams close only a handful of these each month, and fixing a highest-severity application vulnerability takes an average of 92 days. Contrast recorded an average remediation rate of 3.4 vulnerabilities per application per month.
Spring4Shell and Log4Shell, both years old, still show up widely in production telemetry.
“For twenty years the discipline of AppSec has been organized around a race: find the vulnerability, decide if it matters, and fix it before somebody with bad intent finds it first,” said Jeff Williams, CTO at Contrast Security, “AI ended that race, and defenders lost it. We are now seeing vulnerabilities weaponized in hours while the average critical fix takes weeks or months.”
Bug bounty programs are pulling back
Zero Day Clock, which aggregates exploit signals from more than 83,000 CVEs, recorded a mean time to exploit of more than two years in 2018. That figure dropped below one year by 2021, and the majority of exploited vulnerabilities in 2025 were weaponized within three weeks.
HackerOne paused new submissions to the Internet Bug Bounty program in March 2026, the longest-running crowdsourced vulnerability program in open source. Node.js paused its own bounty program shortly afterward, citing the loss of that funding.
AI is changing the equation from both sides
Contrast set three AI scanners loose on the same codebase and found they agreed on 5 percent of findings. Running a single scanner three times against identical code reproduced 17 percent of its own findings. Scanning a 2-million-line codebase with AI tools cost around $315 in API charges. Triaging the resulting findings cost around $128,000.
“AI is not going to triage its way out of this problem, and we have the data to prove it, noted David Lindner, CISO at Contrast Security.
“These tools disagree with each other; they disagree with themselves from one run to the next, and none of them can tell me how my application behaves when someone is actually attacking it. That is fine when AI is one input among several. It is a problem when it becomes the system of record, because that is what decides what my team works on Monday morning,” added Lindner.
Severity scores and exploit data pull in different directions
CVSS severity scores and EPSS exploit-probability scores each carry signal on their own. Among CVEs on CISA’s Known Exploited Vulnerabilities list in the dataset, 82 percent carried an EPSS score of 90 percent or higher.
Two CVEs in the dataset, CVE-2006-1547 and CVE-2023-38180, each carried a CVSS score of 7.5 with EPSS scores under 25 percent, and both were confirmed exploited in the wild.
More than 60 percent of applications see fewer than 3,000 attacks per month. More than a quarter absorb upward of 30,000 attacks per month.
