Veracode Warns of "Remediation Crisis" as AI-Driven Development Outpaces Security Fixes

Veracode's State of Software Security report warns that rapid AI-driven development is creating a "remediation crisis" where vulnerabilities outpace fixes.

By: AXL Media

Published: Feb 28, 2026, 7:23 AM EST

Source: The information in this article was sourced from The Register

The Accelerating Crisis of Security Debt

According to Veracode’s latest data, based on the testing of 1.6 million applications, the software industry has reached a "crisis proportion" regarding its ability to fix known vulnerabilities. The company defines "security debt" as flaws that remain unresolved for more than a year; this debt now affects 82 percent of organizations, a significant jump from 74 percent the previous year. Even more concerning is the rise in high-risk vulnerabilities those that are both severe and likely to be exploited which have increased from 8.3 percent to 11.3 percent. The report suggests that the sheer volume of code being generated, fueled largely by AI tools, is simply overwhelming traditional security review and patching cycles.

Navigating the Complex Regulatory and Technical Environment

The surge in vulnerabilities is attributed to a "triple threat" of high-velocity development, increasing technical complexity, and the proliferation of AI-generated code. While automated testing tools are becoming more common potentially leading to more flaws being spotted than in the past they also contribute to a growing burden of false positives. Veracode’s analysis highlights that the competitive landscape now demands weekly or even daily software releases, leaving developers with little time to address existing flaws before moving on to new features. This environment requires a sophisticated regulatory and operational shift, moving away from incremental fixes toward a more fundamental "transformational change" in how software is built and secured.

Strategic Rationale for AI-Augmented Security

The strategic rationale presented by Veracode is a double-edged sword: while AI is contributing to the problem by generating buggy code at scale, it is also being touted as a potential solution. AI tools are increasingly being integrated into the Software Development Life Cycle (SDLC) to automate the identification of vulnerabilities and suggest fixes. According to industry analysts, the goal is to achieve "autonomous remediation," where AI fixes code as fast as it creates it. However, the report notes that relying on AI for security carries its own risks, including susceptibility to prompt injection attacks and the potential for AI to "hallucinate" security fixes that introduce even more subtle errors.