Summary
- Sonatype’s four-year study found critical and high vulnerabilities per enterprise application increased 4.31 times.
- Average monthly application creation rose 4.84 times while remediation also became faster.
- The data suggests application-security pressure is increasingly driven by the volume and speed of dependency decisions, not remediation performance alone.
Enterprise applications are accumulating more serious vulnerabilities even as organisations fix issues faster, according to new four-year research from Sonatype that tracks how software risk has changed during the rise of AI-assisted development.
The company analysed a fixed cohort of enterprise applications continuously monitored between June 2022 and June 2026. By following the same applications over time, the research aims to separate genuine changes in software risk from changes caused by adding new customers or altering the sample.
Sonatype found that critical and high-severity vulnerabilities per application increased 4.31 times across the study period. The average application carried 14.14 critical and high vulnerabilities in June 2022, rising to 54.3 by 2026.
At the same time, average monthly enterprise application creation increased 4.84 times, while newly affected component versions grew at 46 times the pre-AI rate. The number of new vulnerability advisories entering Sonatype’s research catalogue also increased fourfold over the 49-month period.
The picture is not simply one of declining security performance. Remediation has accelerated as well. Sonatype said the median age of unresolved critical and high vulnerabilities fell 59% from its January 2024 peak, and more than half of resolved violations were addressed within a single day.
The contradiction is structural: organisations are improving at fixing known problems, but the volume of software, dependencies, and newly disclosed risk is increasing faster.
Dependency decisions multiply with development speed
Modern applications depend heavily on open-source components, and every new application or version can introduce dozens or hundreds of dependency decisions. AI-assisted coding and automated development systems can make those selections much faster, which raises the number of opportunities for outdated, vulnerable, or poorly maintained components to enter software.
Sonatype examined vulnerable dependencies introduced into applications during the AI era and found that a materially lower-risk version was already available at the moment of selection in a substantial share of cases. The figure was 62.2% for Maven, 46.9% for npm, and 34.3% for PyPI.
That does not mean developers deliberately chose insecure components. A dependency may appear acceptable based on the information available at the time, while a coding assistant or automation system may lack current context about maintenance status, vulnerability intelligence, organisational policy, or safer alternatives.
The distinction becomes more important as development systems become more autonomous. A human developer selecting a package may make one decision at a time; an AI assistant or automated workflow can repeat the same weak decision across many projects in seconds.
That changes the economics of application security. Faster remediation remains valuable, but fixing problems after they enter an application becomes increasingly expensive when the number of applications and dependency changes rises sharply. Preventing a risky component from entering the build can remove multiple downstream remediation tasks before they exist.
The Sonatype data does not establish that AI alone caused the increase in vulnerabilities. Better vulnerability research, higher disclosure volumes, changing attacker behaviour, wider open-source use, and improvements in detection all contribute to the numbers. The study instead shows the operating environment that development teams now face: more software, more dependencies, and more security information arriving at once.
That environment puts greater weight on controls embedded directly into software creation. Component intelligence, policy enforcement, provenance, and automated checks need to operate at the same speed as the systems choosing dependencies, rather than relying on security review after code has already been assembled.
Application security therefore faces a throughput problem as much as a vulnerability problem. Organisations may be resolving individual findings faster than before, but the software estate is expanding rapidly enough that aggregate exposure can continue to rise.
Sonatype’s four-year dataset captures that tension clearly: remediation is improving, yet risk per application is still climbing. As AI-driven development increases software output further, the effectiveness of security controls will depend increasingly on whether they can influence component choices before those choices become part of production software.
