Industry reports highlight growing software security debt and DevSecOps supply-chain exposure

Recent industry reporting based on Veracode’s 2026 State of Software Security findings indicates security debt—defined as known vulnerabilities left unresolved for more than a year—has become a widespread governance and risk-management issue for CISOs. Across analysis of 1.6 million unique applications assessed via static/dynamic analysis, SCA, and penetration testing, Veracode reported security debt present in 82% of organizations (up from 74% in 2025) and critical security debt in 60% (up from 50%), reflecting that long-lived, high-severity/high-exploitability issues are increasingly persisting across release cycles, particularly in legacy or high-dependency code where teams are reluctant to make changes.

Separately, Datadog’s State of DevSecOps 2026 reporting describes software supply-chain and pipeline practices that sustain this exposure in cloud-native environments: 87% of organizations were observed running at least one exploitable vulnerability in production services, affecting 40% of those services. The report highlights growing dependency lag (median 278 days behind the latest major version, up from 215 days) while also noting a countervailing risk pattern where half of organizations adopt third-party libraries within one day of release, increasing the chance of ingesting malicious or insufficiently vetted code; it also flags build/pipeline surface area (e.g., widespread GitHub Actions usage) as part of the broader DevSecOps risk picture.