AI-Accelerated Exploitation Demands a New AppSec Operating Model

The cybersecurity community is grappling with a significant paradigm shift: public-facing applications have emerged as the leading initial access vector for breaches, a trend dramatically accelerated by advancements in artificial intelligence. Recent industry reports indicate a substantial year-over-year increase in attacks originating from the exploitation of public-facing applications, with a concerning percentage of disclosed vulnerabilities requiring no authentication, offering attackers a direct path to impact. This development underscores a critical vulnerability misalignment where traditional infrastructure-focused security playbooks fail at the application layer, largely because modern application risks often lack standard CVE patches and can only be effectively validated through runtime application security testing. This matters profoundly to CISOs, AppSec leads, and DevOps teams. The rapid evolution of AI, particularly frontier AI, has compressed attacker timelines, rendering legacy AppSec cadences insufficient. The integration of AI components into applications — whether through LLM-powered features, agentic workflows, or Model Context Protocols (MCPs) — introduces new data exposure paths and attack surfaces that were not present during earlier threat modeling. For security leaders, this means AI security can no longer be treated as a separate, checklist-based exercise; it must be an intrinsic part of application security, covering the deployed application, APIs, identity flows, data exposure paths, and embedded AI components holistically. This trend fits squarely within the broader, well-established movement towards DevSecOps, but with an accelerated urgency. While "shift-left" principles have pushed security earlier into the development lifecycle, the current threat landscape, amplified by AI, necessitates an equally strong "shift-right" focus on runtime security and continuous validation. The industry has long recognized the need for continuous integration and continuous delivery (CI/CD) in software development; now, continuous security validation, especially at runtime, is paramount. This evolution mirrors the ongoing efforts to move from static, point-in-time compliance to continuous assurance, as seen in initiatives like the modernization of FedRAMP, which emphasizes persistent validation and machine-readable security data to respond to threats at the speed of autonomous systems. In practice, this means practitioners must adopt a new AppSec operating model. Organizations need to extend their risk-operations model to web applications and APIs, moving beyond fragmented tools and periodic assessments. This involves implementing a unified control plane for discovery, runtime testing, malware detection, prioritization, and remediation. Key actions include validating security at runtime to determine if findings are exploitable in the deployed environment, rather than just identifying suspicious code patterns. This runtime validation should encompass OWASP Top 10, OWASP API Security Top 10, authentication flaws, broken object-level authorization, injection, sensitive data exposure, OAS drift, and production-only misconfigurations. Furthermore, security teams must ensure that application and API findings are integrated into broader enterprise risk contexts, allowing application exposure to be analyzed alongside infrastructure, cloud, and other risk signals. The goal is to transform application security from a specialized testing function into a measurable, continuous risk-reduction program that keeps pace with AI-accelerated threats.