Enterprise applications now carry 4.31 times more Critical and High-severity vulnerabilities than they did four years ago, according to new research from Sonatype, Infosecurity Magazine reported. The software supply chain company says application creation accelerated almost fivefold over the same period, and that security teams are remediating faster even as the volume of risk keeps climbing.
How the Study Worked
Sonatype’s report, The AI-Era Software Assembly Line, follows a fixed cohort of enterprise applications that the company has scanned continuously since June 2022. Holding the customer group constant is meant to show how software risk changed over time rather than reflecting new customers or portfolio changes. The report treats March 2024 as the start of the AI era and covers 49 months through June 2026.
Over that period the average application went from 14.14 Critical and High vulnerabilities to 54.3, a summary of the research by The KB notes. Excluding older applications that were recently brought under management still leaves a 3.91x increase.
The Risk Is Coming From the Ecosystem
The report does not blame the rise on bad AI-written code. Sonatype points to the open source ecosystem itself. The rate of new vulnerability advisories entering its research catalog grew 4.17x over the 49 months, and every month since March 2024 has exceeded the pre-AI trend line. At the same time, organizations created far more new applications after March 2024 than in the two previous years. Roughly 58% of those new AI-era apps were organic new development, and the rest came from bulk onboarding of existing portfolios.
Faster Fixes, Not Fast Enough
Remediation has improved sharply. The median age of unresolved vulnerabilities has fallen 59% from its peak, and more than half of resolved violations are fixed in under a day. Even so, nearly half of the earliest AI-era Critical and High vulnerabilities remained unresolved after more than a year.
“AI is changing the math of software development. We’re building more software, faster, but we’re also introducing risk faster than traditional security processes can absorb it,” said Brian Fox, Sonatype’s co-founder and CTO. “The answer can’t be to put another review step at the end. We need to make better decisions at the moment software is assembled, whether that decision is being made by a developer or an AI agent.”
Mitchell Johnson, Sonatype’s chief product development officer, added, “Developers shouldn’t have to choose between moving at AI speed and understanding the software they’re bringing into the organization.”
What It Means for AppSec Teams
The practical lesson is to move dependency decisions earlier. When an engineer or a coding agent pulls in a component, policy checks on known vulnerabilities and maintenance status should run at that moment, not weeks later in a release review. Teams that already fix issues quickly will still fall behind if the number of risky components entering their applications grows faster than their capacity to remove them.
WebProNews is an iEntry Publication