We put the 2026 State of Application Security Report in front of Jake Bernardes, CISO at Anecdotes and a former penetration tester, and Roi Nisimi, Principal Security Researcher at Orca Security for real-world perspectives on the key findings.

Here’s the breakdown of the major themes covered and what they mean for teams on the ground and security leaders:

1. Velocity is the variable that changed everything, not AI itself

The 2026 report shows 78% of organizations running production applications with critical vulnerabilities, and nearly 50% are still harboring Log4Shell-vulnerable systems. The instinctive reaction is to blame AI-assisted development. But that’s not quite the right diagnosis.

From Roi Nisimi’s researcher perspective, the underlying vulnerability classes haven’t changed. What has changed is how fast code moves from a developer’s prompt to a production environment, sometimes bypassing code review, branch protection, and CI/CD gates entirely. The report found that roughly 26% of organizations aren’t enforcing code reviews at all, and some allow GitHub Actions to auto-approve pull requests.

For security leaders, that reframes the problem. The question isn’t how to slow AI development down. It’s how to ensure that the hygiene controls that existed before AI, the ones that were already inconsistently applied, don’t get abandoned entirely in the race to ship faster.

It feels like in the age of AI, we’re saying: I want the fastest car you can sell me. I don’t really care if it’s got seatbelts. I just want fast. And that’s terrifying.

2. Why Do Critical Vulnerabilities Stay Open for 90 Days After Discovery?  

Over 77% of organizations have unpatched high or critical vulnerabilities after 90 days of discovery. Detection is no longer the hard part. The breakdown happens between identifying an issue and actually fixing it.

On the technical side, the challenge is context. Modern applications are deeply modular, built on layers of third-party dependencies, containerised components, and IaC templates. Fixing one thing without knowing what depends on it is a genuine risk. Most teams don’t have a complete picture of what composes their application, which means every remediation decision carries uncertainty about what else it might break.

From Jake’s perspective as a security leader, developer churn compounds this. Institutional knowledge, which components are load-bearing, which third-party packages are business-critical, how services are actually strung together, walks out the door constantly. Without documented remediation playbooks for common scenarios, teams default to deferring.

Your vulnerability list gets longer and longer and longer. But the reality is they never really go down. We are taking an approach which wasn’t fit for purpose twenty years ago and applying it to a world where people are vibe coding and pushing to prod at a speed we never thought possible.

3. Most Secrets Detection Programs Weren’t Built for AI Credentials

One of the sharper findings in the report: 43% of organizations have exposed AI/ML credentials like API keys and tokens for model hosting, inference APIs, and ML platforms. This is a relatively new attack surface that many security programmes haven’t caught up with.

The technical risk is specific. AI credentials typically grant access to proprietary models, sensitive training data, and usage-based services. Unlike a compromised database credential, an exposed AI API key can enable model manipulation, data exfiltration, and significant unexpected billing charges, all without triggering conventional security alerts.

For CISOs, this is a prioritization signal. Secrets detection programs that were built around database credentials and cloud access keys need to be updated to treat AI tokens with the same urgency. The exposure rate suggests most programs haven’t made that adjustment yet.

4. One Malicious Package Can Cascade Across Your Entire Environment 

11% of organizations are running publicly known malicious packages in production. The supply chain attack surface like NPM packages, containerised base images, IaC modules, and increasingly, AI-generated code and marketplace skills, is where a single compromise becomes a wide-blast-radius incident.

Roi’s researcher perspective here is grounded in how attackers actually think. A malicious package doesn’t need to be in wide use to be effective. It needs to be in the right place, such as inside a CI/CD pipeline, embedded in a base image that gets replicated across an environment, or sitting in an IaC template that gets instantiated hundreds of times. The cascading risk from a single compromised dependency is exponential, not linear.

The governance gap is in how teams treat third-party components. Star counts and credible authors are the primary trust signals most developers use, and sophisticated attackers have learned to game both. Treating supply chain security as an ongoing operational discipline, not just a periodic audit, is the shift that separates teams who catch these issues from teams who don’t.

The issues are the same issues. They just get different names. Hygiene is the main part — but you should always be reactive to what’s going on in the world, because hackers read the same news you do. It all comes down to who reacts faster.

5. What Separates Security Teams That Reduce Risk From Teams That Just Generate Alerts 

What actually separates the security teams that are reducing real risk from the ones that are generating more alerts? The answer that emerged from both perspectives came down to three things working together.

Continuous, real-time visibility into the production environment, not point-in-time snapshots. The context to understand which vulnerabilities are actually reachable and exploitable versus theoretical. And human expertise with an offensive mindset capable of looking at the data and knowing when the numbers are understating or overstating the risk.

The talent dimension is where Jake says CISOs have the most direct lever to pull. Security teams built primarily from generalists struggle with the technical depth needed to reason about modern application architecture. Bringing in people with engineering or red team backgrounds, or investing in developing that capability internally, changes what a security program can actually see and act on.

Ensure you have capable engineering and ex-hacking resources in your team so they can think like a hacker, think like an engineer. Think about the things that are the crown jewels — the things attackers are going to replicate into your environment the most — and protect those first.

Where Does This Leave Security Teams?

Neither Jake nor Roi was optimistic about a step-change improvement in the overall AppSec landscape over the next five years. The honest assessment: the industry will get better at remediation, better at prioritization, and smarter about how AI-generated code gets reviewed. But the attack surface will grow faster than those improvements, and the democratization of AI-powered offensive tooling means the barrier to entry for attackers is collapsing.

What that means practically is that the gap between organizations with mature security programs and those without is going to widen. The fundamentals, such as secrets hygiene, dependency management, enforced code review, and continuous runtime visibility haven’t changed. What’s changed is the cost of not doing them.

How Orca Security Helps

The findings in the 2026 State of Application Security Report reinforce a challenge many security teams already feel: visibility alone is not enough. Organizations need the ability to understand which risks are truly exploitable, how they connect across applications and cloud environments, and what should be fixed first.

Orca Security helps security teams cut through the noise by providing unified visibility across cloud, application, and AI environments, enriched with context and risk prioritization. By connecting vulnerabilities, secrets, dependencies, misconfigurations, and attack paths to real-world business impact, Orca helps organizations focus resources where they will reduce risk the most and accelerate remediation before attackers can take advantage.

Watch the full conversation

The webinar covers more ground than we could capture here, including how Jake used Xbox prizes to build a security culture without a compliance mandate, Roi’s live walkthrough of how non-internet-facing vulnerabilities still get exploited, and a debate between the two on whether traditional AppSec tools are broken or just behind.

Watch the full webinar for a deeper dive into the conversation.