Securing Software at the Speed of AI: What Four Years of Data Reveal
Blog post from **Sonatype** by **Aaron Linskens** (*technical writer*), published on **August 18, 2026**, ~1,300 words: it recounts a **Sonatype Research Labs** study spanning **49 months** (June 2022 — June 2026) and a **fixed cohort** of enterprise applications, a methodological choice asserted to isolate the evolution of the application fleet rather than that of the customer portfolio. The result is presented as a contradiction: remediation is faster, yet risk accumulates further. (A) **The stock is rising** — *Critical* and *High* vulnerabilities per application **×4.31** (from **14.14** in June 2022 to **54.3** in 2026, still **×3.91** excluding legacy applications newly brought under management), newly affected component versions at **46×** the pre-AI rate, monthly application creation **×4.84**. (B) **Remediation is improving** — more than half of resolved violations are resolved in under a day, the median age of unresolved *Critical/High* vulnerabilities drops from **228** to **126 days**, then to **103** in May 2026; among cohorts that had twelve months, **52.6%** are resolved, **44.3%** open, **3.1%** under waiver. (C) **The proposed lever is component selection**: at the moment a vulnerable dependency was chosen, a substantially less risky version already existed in **62.2%** of cases on **Maven**, **46.9%** on **npm**, **34.3%** on **PyPI** — a gap the text attributes to an information gap rather than developer fault. The post itself states that AI is not the sole cause of the acceleration, and concludes on **Sonatype Guide**, which brings this intelligence to the point of selection. On the supply-chain side, it extends what [[fiches/2026-08/staples-gitlab-when-code-is-abundant-2026-08-24]] frames in economic terms and [[fiches/2026-07/clinton-anthropic-secure-ai-native-sdlc-2026-07-21]] in secure-cycle terms.
Aaron Linskens · *technical writer* chez Sonatype · sur le blog de l'éditeur ; les chiffres sont produits par Sonatype Research Labs · non par l'auteur.