AI AppSec tools agree on just 5% of security findings
Contrast Security report finds 42 confirmed exploit attempts per application monthly and three AI scanners agreeing on only 5% of findings.
Contrast Security's AppSec Overflow 2026 report, drawing on telemetry from hundreds of thousands of production applications and APIs, found adversaries touch the average application every four minutes with 42 confirmed viable exploit attempts per application monthly, led by untrusted deserialization, path traversal, and method tampering. Legacy flaws Log4Shell and Spring4Shell remain widespread, mean time to exploit fell from over two years in 2018 to under three weeks for most 2025 exploited vulnerabilities, and average critical fix time is 92 days. Three AI scanners set on the same codebase agreed on only 5% of findings, and triaging a 2-million-line codebase scan cost roughly $128,000 versus $315 in API charges. Among exploited CVEs in the dataset, 82% of KEV-listed entries carried EPSS scores of 90% or higher, while CVE-2006-1547 and CVE-2023-38180 were confirmed exploited despite EPSS scores under 25%.
- Average application sees attacker contact every four minutes; 42 confirmed viable exploits per application monthly.
- Untrusted deserialization, path traversal, and SQL injection lead confirmed exploit techniques; Log4Shell and Spring4Shell persist.
- Mean time to exploit dropped from over two years in 2018 to under three weeks in 2025.
- Three AI scanners agreed on 5% of findings; a single scanner reproduced 17% of its own findings across runs.
- HackerOne paused the Internet Bug Bounty in March 2026; Node.js bounty paused soon after.
- Products
- Log4ShellSpring4Shell
- Organizations
- CISAHackerOneZero Day Clock
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2006-1547 | Denial-of-Service in Apache Struts 1 ActionForm (pre-1.2.9) | — | 55% | KEV | — KEV |
| CVE-2023-38180 | Unauthenticated DoS in Microsoft .NET, ASP.NET Core and Visual Studio 2022 | 7.5 | 14% | KEV | KEV |
From the original article
3 min read at helpnetsecurity.com
Software vulnerabilities are turning into exploits within hours, and application security teams carry patch backlogs that go back years. Top types of viable application attacks (Source: Contrast Security) Contrast Security’s AppSec Overflow 2026 report draws on telemetry collected from inside hundreds of thousands of production applications and APIs.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.