Artificial intelligence is making it easier to write software, find vulnerabilities, and automate tedious security work. Unfortunately, hackers get to use the same technology.
New research from Contrast Security suggests attackers are finding and exploiting vulnerabilities at a pace that defenders simply cannot match. The problem is not necessarily that security teams are doing a bad job. There may just be too many vulnerabilities, too many attacks, and not enough time to fix everything.
According to Contrast’s AppSec Overflow 2026 report, the average application it monitors faces 11,382 attacks every month. That works out to roughly one attack every four minutes. Most are probes or suspicious activity rather than successful exploitation attempts, but the company says the average application still encounters 42 “viable attacks” each month.
Contrast uses that term specifically for exploitation attempts that reach and trigger an actual vulnerability in a running application. In other words, the 42 figure is not simply a count of bots knocking on the front door. Fixing those vulnerabilities is considerably slower.
Contrast says the average application carries 106 vulnerability findings, including 22 rated High or Critical. Development and application security teams remediate an average of just 3.4 vulnerabilities per application each month. A critical vulnerability in custom application code takes an average of 92 days to fix. Attackers may not need anything close to 92 days.
The report points to data showing that the time between disclosure and exploitation has fallen dramatically. It says the average was measured in years in 2018, while vulnerabilities can now be weaponized within hours. Contrast argues AI is helping accelerate that process by lowering the amount of expertise and time required to discover vulnerabilities and develop working exploits.
Making matters worse, old vulnerabilities are not disappearing. Contrast says 54 percent of the CVE instances it observed in production applications were associated with vulnerabilities disclosed more than a year earlier. Some are much older.
Spring4Shell, disclosed in 2022, remains one of the more widely observed vulnerabilities in Contrast’s dataset. Log4Shell continues showing up too, more than four years after its disclosure. The company says complicated software dependencies can leave vulnerable components buried inside applications long after organizations believe they have dealt with the original problem.
You might assume AI security tools could help defenders catch up. Contrast’s testing suggests things are not quite that simple.
Three AI security scanners analyzing the same codebase agreed on only 5 percent of their findings. Even stranger, running one scanner three times against the same code reproduced only 17 percent of its own findings.
There is also a potentially enormous human cost hiding behind inexpensive AI processing. Contrast says scanning an application containing 2 million lines of code cost roughly $315 in tokens during one test. It estimated that triaging all the resulting findings would cost around $128,000.
That is an important distinction. Finding more potential vulnerabilities does not necessarily make software safer if humans then have to spend their time determining which findings are real and which actually matter.
Contrast believes the traditional approach of finding vulnerabilities, prioritizing them, and eventually patching them is no longer enough. It argues companies need more security inside running applications so exploitation attempts can potentially be stopped before developers have time to deploy a fix.
Of course, that conclusion deserves some skepticism. Contrast sells runtime application security products, and much of the report is based on telemetry collected through its own platform. Its recommendation therefore lines up rather conveniently with what the company sells.
That does not make the underlying numbers meaningless, however. The more interesting issue is the growing difference between machine speed and human speed.
AI can help hackers search for weaknesses around the clock. It can help developers produce more code. It can help security tools generate more findings. Humans are still the ones expected to investigate much of that output and ultimately fix the software.
If vulnerabilities can be weaponized in hours while critical fixes take an average of 92 days, simply finding more vulnerabilities faster may not solve the problem. It could just make the pile even bigger.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz