Rapid AI-driven development makes security unattainable, warns Veracode
Report claims more vulnerabilities created than fixed as remediation gap widens
Veracode has posted its annual State of Software Security report, based on data from 1.6 million applications tested on its cloud platform, finding that more vulnerabilities are being created than are being fixed, and that high-velocity development with AI is making comprehensive security unattainable.
The company defines security debt as “known vulnerabilities left unresolved for more than a year” and reckons this now affects 82 percent of companies, up from 74 percent a year ago. High-risk vulnerabilities, meaning flaws that are both severe and likely to be exploited, have risen from 8.3 percent to 11.3 percent. The figures are from a combination of static analysis (analyzing the code), dynamic analysis (testing runtime behavior), software composition analysis (examining software components such as library dependencies), and manual penetration testing.
There is also some good news. The number of apps with open source vulnerabilities has reduced from 70 percent to 62 percent, and the overall “flaw prevalence” is down from 80 percent to 78 percent.
Related Knowledge Center: Artificial intelligence
On top of a failing business model, newsrooms must navigate the powerful — and not fully reliable — new capabilities of artificial intelligence and the deployment of large language models.
State of the business model | Copyright and intellectual property
Related Knowledge Center: Digital privacy and data security
If you’re online, you’re generating a constant stream of information about yourself — sometimes voluntarily, sometimes unwittingly — that is assembled and used to craft your online experience. And generate wealth for data brokers. Meanwhile, designers and managers of the digital infrastructure on which the world depends are engaged in a never-ending effort to thwart attempts, by both criminal enterprises and state actors, to exploit vulnerabilities in those systems.
Signalgate | State surveillance