For twenty years, application security has run on the recipe: Find the vulnerabilities, decide which ones matter, and fix them before someone exploits them. It has mostly worked up until now, but it doesn’t anymore, and AI is the reason.
Our new report, AppSec Overflow 2026, is built entirely on runtime telemetry from inside thousands of live applications and APIs, and it paints a picture that’s hard to argue with. Vulnerabilities are being exploited every day. Fixes take months. AI is pouring new flaws into production faster than anyone can clear them, and the tools meant to help sort the mess are proving less reliable than advertised. Here is what the data shows, and why it matters.
The average application we monitor gets hit by 11,382 attacks a month. That works out to roughly once every four minutes, around the clock. Most of this is noise, the automated background hum of the internet, but a surprising amount is not. Every month, the average application absorbs 42 viable attacks. A viable attack in this context means it reaches real vulnerable code in a running application, seen from inside the application as it happened. Against a backdrop of hundreds of applications, 42 per app becomes thousands of confirmed hits a month.
Digging deeper, the report highlights the techniques seen most often in real-world attacks, both globally and by industry. Untrusted deserialization, path traversal, method tampering and SQL injection top the list, showing that while we might patch individual vulnerabilities, some classes of exploits are here to stay.
None of the attack pressure would sting so much if defenders could close the gaps quickly. They cannot. Our data puts the average time to remediate a critical application vulnerability at 92 days. Patching production takes change management, dependency checks, regression testing, and a maintenance window that does not always come when you want it.
The trouble is that the three-month clock is racing. The gap between a vulnerability going public and a working exploit showing up has shrunk from years, a decade ago, to hours today. When exploitation happens in hours and the fix takes months, patching stops being defense and becomes cleanup.
Figure 1: Viable application attacks seen in 2026
The backlog math is just as unforgiving. The average application carries 22 serious vulnerabilities, the High and Critical ones attackers actually go after, and teams close about 3.4 a month. In third-party libraries running in production, more than half of the vulnerabilities we see trace back to CVEs disclosed over a year ago. Log4Shell, four years after it set the security world on fire, is still prevalent in production environments today.
An organization can do everything right and still watch its exposure climb, because vulnerabilities arrive faster than any team can clear them.
If AI is flooding the pipeline with findings, the obvious move is to point AI at the pile and let it sort things out. We wanted that to work, so we tested it, and found that it doesn’t hold up.
We ran three AI security scanners against the same codebase. They agreed on 5% of what they found. Then we ran a single scanner three times against code that never changed, and it reproduced just 17% of its own results. Same tool, same code, three different answers. You cannot anchor a risk program to something that changes its mind every time you ask. These tools can be useful as one input among several, but the moment you treat them as the source of truth, you have automated your own confusion.
If you can only close a handful of vulnerabilities to remediate this week, you want to focus your time on the ones that carry the most risk. So how do you choose? Prioritization often uses standard industry metadata. CVSS rates how severe a vulnerability is in theory. EPSS estimates how likely it is to be exploited. The CISA KEV list flags the ones known to be exploited in the wild. All three are useful, and our data backs that up: of the known-exploited vulnerabilities we see in production, the large majority also carry a high EPSS score. Exploit prediction often aligns with exploit reality.
But these data points only describe the vulnerability. They cannot tell you a thing about your application. They don't know whether the vulnerable code even runs in your environment, whether an attacker can reach it, or whether the app is quietly humming along behind an internal firewall or absorbing thirty thousand attacks a month from the open internet. Two apps can carry the identical flaw and face completely different real-world risk, and no score on paper will tell you which is which.
The hard work of finding and fixing vulnerabilities still matters, but it can no longer carry the whole load, because no monthly patch cycle catches hourly exploitation, and no code review keeps up with AI-generated software without bringing development to a crawl.
The game-changer is moving defense inside the application, where you can watch what the code actually does. Instead of guessing whether a vulnerability is exploitable, you see whether the vulnerable code runs, whether untrusted data reaches it, and whether someone is attacking it right now. A queue of a hundred-plus findings collapses to the handful that are genuinely reachable. And because you are watching in real time, you can block an attack whether or not the underlying flaw has been patched, or even discovered yet.
If these insights caught your attention, we recommend the full report for the rest of the story. It covers attack data by industry, the aging vulnerabilities still lingering in production, and the hard numbers on AI scanner reliability—the kind of detail that helps security leaders make better AppSec decisions in 2026 and beyond.