The Growing Chasm: Vulnerability Backlogs Swell Despite Faster Remediation in the AI Era

A recent HackerOne report highlights a concerning trend in the DevSecOps landscape: organizations are resolving vulnerabilities faster than ever, yet their overall backlog of unresolved issues is expanding at an alarming rate. The report indicates a 54% increase in the rate of vulnerability resolution over the past year, with average resolution times dropping from 135 days to a mere 62 days. However, this efficiency is being outpaced by a 131% increase in the total number of known, validated issues that remain unaddressed over the last two years. A significant 70% of surveyed security leaders admit that new findings are accumulating faster than their teams can remediate them. This situation is particularly critical for DevSecOps professionals because it underscores the escalating pressure on security teams in the age of AI. AI is not only accelerating software development but also the discovery and exploitation of vulnerabilities. Security researchers are leveraging AI to find more issues, with 85% actively upskilling in AI and nearly three-quarters reporting a meaningful increase in valid findings. This creates a scenario where even highly efficient remediation processes cannot keep pace with the influx of new threats. The traditional reactive model of security is proving insufficient, necessitating a more proactive and automated approach. This trend fits squarely within the broader movement towards "shift-left" security and the increasing recognition of "exposure debt." The concept of shift-left security, which advocates for integrating security earlier into the development lifecycle, aims to catch vulnerabilities before they become deeply embedded and costly to fix. However, even with shift-left practices, the sheer volume of potential issues generated by accelerated development and AI-driven vulnerability discovery means that some level of exposure debt—the accumulation of known but unaddressed security risks—is inevitable. The report also notes a 557% increase in system prompt leakage reports and a 264% increase in output handling issues, directly attributable to the use of AI in code generation. This highlights new attack vectors and the evolving nature of vulnerabilities that DevSecOps teams must contend with. In practice, this means DevSecOps teams must prioritize automation beyond just remediation. They need to invest in AI-powered tools that can provide context-aware security feedback directly within developer IDEs, enabling a "shift smart" approach. Furthermore, organizations must formally track and manage exposure debt, moving beyond simply resolving individual vulnerabilities to understanding and mitigating the cumulative risk. This includes robust software supply chain security practices, such as SBOMs, artifact signing, and dependency management. Practitioners should also focus on building a strong security culture where security is a shared responsibility, supported by training and clear processes for handling findings, rather than solely relying on technology. The goal is not just to fix bugs faster, but to fundamentally reduce the attack surface and manage risk more effectively in an environment where the pace of change is constantly accelerating.