AI-assisted development is changing the speed at which software gets built, but speed is only part of the story.

As developers, AI assistants, package managers, and increasingly autonomous agents assemble software faster, they make more decisions about the open source components and versions entering applications. At the same time, the vulnerability landscape keeps changing.

To understand that shift, Sonatype Research Labs studied four years of software assembly data from a fixed cohort of enterprise applications continuously monitored between June 2022 and June 2026. By following the same applications over time, our research isolates changes in the software environment rather than changes caused by customer acquisition or sample composition.

What emerged was a striking contradiction. Organizations are getting faster at fixing vulnerabilities, yet their applications are still accumulating more risk. The numbers explain why.

The AI-Era Software Supply Chain, by the Numbers

Sonatype research reveals a software security landscape changing on multiple fronts. Applications are accumulating more risk even as remediation and software development accelerate.

Four statistics stand out:

• Critical and High vulnerabilities per application increased 4.31x, showing that the average enterprise application is carrying substantially more serious risk.

• Newly affected component versions increased at 46x the pre-AI rate, expanding the volume of software that may require evaluation.

• Median vulnerability age fell 59% from its January 2024 peak, evidence that organizations are getting faster at remediation.

• Average monthly enterprise application creation increased 4.84x, multiplying the dependency decisions made across development organizations.

Together, these trends show why security at AI scale must extend beyond remediation to improving component decisions before risk enters an application.

Enterprise Applications Are Carrying More Risk

In June 2022, the applications analyzed carried an average of 14.14 Critical and High-severity vulnerabilities per application. By 2026, that number had climbed to 54.3.

This isn't simply a legacy-application effect. Even after newly managed legacy applications were excluded, risk per application still increased 3.91x.

An application doesn't become riskier only when its code changes. A dependency considered acceptable yesterday may receive a new vulnerability disclosure tomorrow. A component may become unmaintained or a safer release may appear. The code can stay the same while its security profile changes.

The Vulnerability Landscape Is Expanding

New vulnerability advisories entering Sonatype's research catalog grew 4x over the 49-month study period, with every month since the beginning of the AI era exceeding the historical baseline.

Those findings create two related pressures:

• More vulnerability advisories mean organizations are receiving new security information faster.

• More affected component versions mean those disclosures touch far more software that may require investigation or remediation.

AI alone did not cause this acceleration. Better vulnerability research, improved disclosure, AI-assisted security research, changing attacker behavior, and other factors may contribute.

Organizations don't need to prove a single cause to confront the outcome. The scale itself is the problem.

Security Teams Are Fixing Vulnerabilities Faster

The encouraging part of the research is that remediation is improving.

More than half of resolved violations were addressed within a single day, and the age of unresolved Critical and High vulnerabilities has declined substantially.

The data shows meaningful progress:

• The typical unresolved Critical and High vulnerability became 45% younger during the AI era, dropping from 228 days to 126 days.

• By May 2026, that median had fallen further to 103 days.

• Among early AI-era Critical and High vulnerability cohorts with at least 12 months to remediate, 52.6% were resolved, while 44.3% remained open and 3.1% were waived.

Automation makes cleanup more efficient. But cleanup still happens after the component decision that created the work. That makes prevention increasingly valuable.

How Often Was a Safer Dependency Already Available?

At the same time that vulnerability management is accelerating, organizations are building significantly more software.

Our researchers examined vulnerable dependencies introduced into AI-era applications and asked: At the moment this dependency was selected, was a materially lower-risk version already available?

Often, the answer was yes:

• Maven: 62.2%

• npm: 46.9%

• PyPI: 34.3%

This should not be interpreted as developer failure.

Some vulnerabilities are unavoidable because the ecosystem doesn't offer a safer option. Others are information problems: The developer or AI assistant making the selection doesn't have the right context when the decision is made.

That distinction becomes especially important in AI-assisted development. An AI coding assistant can recommend and introduce components in seconds. But a fast recommendation is not necessarily an informed one. The assistant needs current intelligence about component risk, available versions, maintenance, security, and organizational policy — not only information encoded in its underlying model.

The Next Leverage Point Is Component Selection

Traditional vulnerability management typically begins after a dependency enters the software. The application is scanned, policies are evaluated, a violation surfaces, and remediation begins.

That remains necessary when a risky component has already been adopted. But the research points toward another opportunity: Reduce avoidable risk before it becomes remediation work.

This is the leverage point Sonatype Guide is designed to address.

Sonatype Guide brings our component intelligence into the places where developers and AI assistants are already making software decisions. Instead of waiting for a later scan to identify a poor component or version choice, Guide helps surface relevant context during development, including inside AI-assisted workflows.

That means helping developers and AI systems make informed decisions about:

• Component and version risk

• Safer available versions

• Policy and organizational requirements

• Current software supply chain intelligence

The security question can then shift from "How quickly can we fix the vulnerable dependency we selected?" to "Can we select the safer dependency in the first place?"

For developers, that brings intelligence closer to the coding workflow. For AI assistants, it provides current software supply chain context that model knowledge alone cannot guarantee.

Faster Remediation and Better Prevention Belong Together

None of this makes vulnerability management less important. Organizations have made meaningful progress in remediation.

At AI scale, the next evolution of software supply chain security isn't just about finding vulnerabilities sooner or fixing them faster. It's also about helping developers — and the AI systems working alongside them — make better component decisions from the start.

Explore the full research in "The AI-Era Software Assembly Line" to see all findings, the underlying data, and what they reveal about the changing software supply chain.

And learn how Sonatype Guide brings trusted component intelligence into developer and AI-assisted workflows to help teams make better software decisions at the point of selection.