Enterprise Applications Carry 4.31x More Critical and High Vulnerabilities

Enterprise applications now carry 4.31 times more critical and high-severity vulnerabilities than before the acceleration of AI-driven software development.

Sonatype analyzed four years of enterprise software development data and found that application creation has accelerated almost fivefold in the AI era.

At the same time, the median age of unresolved vulnerabilities has fallen 59%, suggesting organizations are fixing vulnerabilities faster even as the volume of risk grows.

“Developers shouldn’t have to choose between moving at AI speed and understanding the software they’re bringing into the organization,” said Mitchell Johnson, chief product development officer at Sonatype.

In the report, the firm said the findings show that software creation is accelerating faster than traditional security processes can absorb, creating pressure to identify and address risk earlier in development.

Read more on AI vulnerability management: US Launches Gold Eagle to Coordinate AI-Driven Vulnerability Management

AI Accelerates Software Creation and Risk

The report links the shift to the growing use of artificial intelligence in software development. Sonatype said teams are producing applications at a much faster rate while carrying more critical and high-severity vulnerabilities.

The decline in the median age of unresolved vulnerabilities points in the other direction. Teams are shortening the time vulnerabilities remain open, but the faster pace of software creation means remediation improvements have not kept pace with the growth in risk.

Sonatype said organizations need to move security decisions earlier in the software assembly process rather than relying primarily on reviews after development.

“AI is changing the math of software development. We’re building more software, faster, but we’re also introducing risk faster than traditional security processes can absorb it,” said Brian Fox, co-founder and CTO of Sonatype.

“The answer can’t be to put another review step at the end. We need to make better decisions at the moment software is assembled, whether that decision is being made by a developer or an AI agent.”