AI AppSec tools agree on just 5% of security findings
Contrast Security report finds 42 confirmed exploit attempts per application monthly and three AI scanners agreeing on only 5% of findings.
Contrast Security's AppSec Overflow 2026 report, drawing on telemetry from hundreds of thousands of production applications and APIs, found adversaries touch the average application every four minutes with 42 confirmed viable exploit attempts per application monthly, led by untrusted deserialization, path traversal, and method tampering. Legacy flaws Log4Shell and Spring4Shell remain widespread, mean time to exploit fell from over two years in 2018 to under three weeks for most 2025 exploited vulnerabilities, and average critical fix time is 92 days. Three AI scanners set on the same codebase agreed on only 5% of findings, and triaging a 2-million-line codebase scan cost roughly $128,000 versus $315 in API charges. Among exploited CVEs in the dataset, 82% of KEV-listed entries carried EPSS scores of 90% or higher, while CVE-2006-1547 and CVE-2023-38180 were confirmed exploited despite EPSS scores under 25%.
- Average application sees attacker contact every four minutes; 42 confirmed viable exploits per application monthly.
- Untrusted deserialization, path traversal, and SQL injection lead confirmed exploit techniques; Log4Shell and Spring4Shell persist.
- Mean time to exploit dropped from over two years in 2018 to under three weeks in 2025.
- Three AI scanners agreed on 5% of findings; a single scanner reproduced 17% of its own findings across runs.
- HackerOne paused the Internet Bug Bounty in March 2026; Node.js bounty paused soon after.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2006-1547 | Denial-of-Service in Apache Struts 1 ActionForm (pre-1.2.9) Apache Struts 1 versions before 1.2.9, when used with BeanUtils 1.7, contain a denial-of-service vulnerability in how ActionForm beans are populated from request data. An attacker can send crafted HTTP request parameters that, when applied to an ActionForm via BeanUtils, consume excessive server resources and disrupt or crash the affected web application. The impact is availability only — no code execution or access — so an unauthenticated remote attacker gains the ability to degrade or take down the service. Any organization running legacy Java web applications built on Apache Struts 1 prior to 1.2.9 is affected. CISA added this flaw to its Known Exploited Vulnerabilities Catalog on 2022-01-21, confirming in-the-wild exploitation; no public proof-of-concept is known, and any ransomware association is not reported. Do: Upgrade Apache Struts 1 to version 1.2.9 or later as required by CISA's KEV catalog, and inventory deployed WAR/EAR files for bundled Struts 1 and BeanUtils 1.7 jars since the framework is end-of-life. For legacy applications that cannot be patched or migrated to a supported framework, restrict internet exposure or apply WAF/request-filtering controls to limit unauthenticated access to the vulnerable form-handling paths. | — | 55% | KEV |
| mass≈100,000+ exposed systems/applications | |
| CVE-2023-38180 | Unauthenticated DoS in Microsoft .NET, ASP.NET Core and Visual Studio 2022 CVE-2023-38180 is a denial-of-service vulnerability in Microsoft .NET and Visual Studio 2022 caused by uncontrolled resource consumption (CWE-400). Per the CVSS vector, a remote, unauthenticated attacker can trigger it over the network with no privileges or user interaction required, causing affected applications or services to exhaust resources and become unavailable. The attacker gains only availability impact (high availability severity, no confidentiality or integrity impact), but this can take down ASP.NET Core web applications and other .NET-based services. Any organization running vulnerable .NET runtimes, ASP.NET Core applications, or Visual Studio 2022 is exposed, and Fedora also ships affected .NET packages. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-08-09, it was among the two actively exploited flaws fixed in Microsoft's August 2023 Patch Tuesday, and EPSS assigns a 14.0% 30-day exploitation probability (96th percentile). Do: Apply the August 2023 Microsoft security updates for all affected .NET, ASP.NET Core, and Visual Studio 2022 versions listed in Microsoft's advisory, and install the updated .NET packages on Fedora; because this flaw is in CISA's KEV catalog, the required action is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable. After updating, rebuild or restart .NET applications so they run on the patched runtime, and monitor internet-facing .NET services for signs of resource-exhaustion denial-of-service. No public proof-of-concept is known, but active exploitation has been reported, so patching should be treated as urgent. | 7.5 | 14% | KEV |
| masshundreds of millions of potential installations (ubiquity of the .NET runtime and ASP.NET Core in server and web deployments) |
Full article669 words · extracted from helpnetsecurity.com · click to collapse
Software vulnerabilities are turning into exploits within hours, and application security teams carry patch backlogs that go back years.
Top types of viable application attacks (Source: Contrast Security)
Contrast Security’s AppSec Overflow 2026 report draws on telemetry collected from inside hundreds of thousands of production applications and APIs.
Attacks land every few minutes
Adversaries touch the average application once every four minutes. Most of that traffic is automated reconnaissance, scanners mapping out weaknesses and cataloging services.
A smaller slice shows exploit payloads and attempts to manipulate application behavior. Contrast recorded 42 confirmed, viable exploit attempts per application every month, meaning the vulnerability was not just probed, it was triggered.
Untrusted deserialization led the field among these confirmed exploits, followed by path traversal and method tampering. SQL injection showed up in the top five attack techniques for every industry vertical Contrast tracked, from finance to healthcare to manufacturing.
A company with a few dozen employees runs a couple dozen applications and APIs on average. That number climbs with headcount, and organizations with more than 5,000 employees run several hundred applications and APIs on average.
Patch backlogs stretch past a year
Applications monitored by Contrast carry an average of 106 vulnerability findings in code written in-house, including 22 rated high or critical severity.
Development and security teams close only a handful of these each month, and fixing a highest-severity application vulnerability takes an average of 92 days. Contrast recorded an average remediation rate of 3.4 vulnerabilities per application per month.
Spring4Shell and Log4Shell, both years old, still show up widely in production telemetry.
“For twenty years the discipline of AppSec has been organized around a race: find the vulnerability, decide if it matters, and fix it before somebody with bad intent finds it first,” said Jeff Williams, CTO at Contrast Security, “AI ended that race, and defenders lost it. We are now seeing vulnerabilities weaponized in hours while the average critical fix takes weeks or months.”
Bug bounty programs are pulling back
Zero Day Clock, which aggregates exploit signals from more than 83,000 CVEs, recorded a mean time to exploit of more than two years in 2018. That figure dropped below one year by 2021, and the majority of exploited vulnerabilities in 2025 were weaponized within three weeks.
HackerOne paused new submissions to the Internet Bug Bounty program in March 2026, the longest-running crowdsourced vulnerability program in open source. Node.js paused its own bounty program shortly afterward, citing the loss of that funding.
AI is changing the equation from both sides
Contrast set three AI scanners loose on the same codebase and found they agreed on 5 percent of findings. Running a single scanner three times against identical code reproduced 17 percent of its own findings. Scanning a 2-million-line codebase with AI tools cost around $315 in API charges. Triaging the resulting findings cost around $128,000.
“AI is not going to triage its way out of this problem, and we have the data to prove it, noted David Lindner, CISO at Contrast Security.
“These tools disagree with each other; they disagree with themselves from one run to the next, and none of them can tell me how my application behaves when someone is actually attacking it. That is fine when AI is one input among several. It is a problem when it becomes the system of record, because that is what decides what my team works on Monday morning,” added Lindner.
Severity scores and exploit data pull in different directions
CVSS severity scores and EPSS exploit-probability scores each carry signal on their own. Among CVEs on CISA’s Known Exploited Vulnerabilities list in the dataset, 82 percent carried an EPSS score of 90 percent or higher.
Two CVEs in the dataset, CVE-2006-1547 and CVE-2023-38180, each carried a CVSS score of 7.5 with EPSS scores under 25 percent, and both were confirmed exploited in the wild.
More than 60 percent of applications see fewer than 3,000 attacks per month. More than a quarter absorb upward of 30,000 attacks per month.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/08/31/contrast-security-ai-appsec-tools-security-findings-report/