2026 State of Software Security
Partner: Veracode
The 2026 State of Software Security uses Veracode scan data from 1.6 million applications to show why better flaw detection hasn’t led to smaller backlogs. Security debt (flaws left open more than a year) now affects 82% of organizations, up from 74% in 2025, even as overall flaw rates edged down.
Detection keeps improving a little each year. Fix capacity hasn’t moved much, though, so backlogs grow, and the debt piling up fastest is the dangerous kind (flaws that are both severe and likely to be exploited). Most of that critical debt sits in open-source and other third-party components, which take far longer to fix than the average flaw. For AppSec teams, that means fixing faster across the board probably won’t close the gap. The report makes the case for concentrating on severe, exploitable flaws in the applications that matter most.
The full report tracks year-over-year changes in security debt and high-risk flaws, separates first-party from third-party code, and estimates how much of their backlog organizations actually fix each month. It also discusses AI’s possible role in the high-risk increase (something the data can’t measure directly) and closes with specific remediation targets tailored to different kinds of organizations.
Key Findings
- 82% Carry Security Debt: 82% of organizations have flaws left open for more than a year, up from 74% in 2025 (an 11% relative increase).
- 60% Carry Critical Debt: Organizations with severe, highly exploitable flaws open more than a year rose from 50% to 60%.
- 36% Rise in High-Risk Flaws: Flaws rated both highly severe and highly exploitable grew from 8.3% to 11.3% of all findings.
- 66% of Critical Debt Is Third-Party: Third-party code accounts for 66% of critical security debt, down from 70% last year.
- 358-Day Third-Party Half-Life: SCA findings take 358 days to reach half-life, 115 days longer than the 243-day average across all scan types.
- 10% Monthly Fix Capacity: The median organization fixes around 10% of its flaws each month, too slow to keep backlogs from growing.
Independent analysis of 1.6 million unique applications and 141.3 million raw findings from static, dynamic and software composition analysis scans on Veracode’s platform.
Key Risk Insight
Most organizations are accumulating year-old software flaws faster than they fix them, and the most dangerous ones are growing fastest. Treat critical security debt as a standing risk metric, with particular attention to third-party components.
Cite this report: Cyentia Institute and Veracode (2026). 2026 State of Software Security. https://www.cyentia.com/publication/2026-state-of-software-security/