AI AppSec scanners agree on 5% of findings

Application security teams face an impossible race as vulnerabilities are weaponized in hours while critical fixes take an average of 92 days. This is according to the AppSec Overflow 2026 report from Contrast Security, which analyzed telemetry from hundreds of thousands of production applications and APIs.

Attacks Land Every Few Minutes

Adversaries interact with the average application once every four minutes. Most of this activity is automated reconnaissance. However, Contrast recorded 42 confirmed, viable exploit attempts per application every month, where a vulnerability was successfully triggered, not just probed.

Untrusted deserialization was the most common technique among these confirmed exploits. It was followed by path traversal and method tampering. SQL injection appeared in the top five attack techniques for every industry vertical tracked, from finance to healthcare.

Patch Backlogs Stretch Past a Year

Applications monitored by Contrast carry an average of 106 vulnerability findings in custom code, with 22 rated high or critical severity. Development teams close only a handful each month, with an average remediation rate of 3.4 vulnerabilities per application per month. Years-old vulnerabilities like Spring4Shell and Log4Shell remain widespread in production.

Jeff Williams, CTO at Contrast Security, stated that AI has ended the traditional AppSec race. "We are now seeing vulnerabilities weaponized in hours while the average critical fix takes weeks or months," he said.

Exploit timelines have compressed dramatically. According to Zero Day Clock, the mean time to exploit dropped from over two years in 2018 to below one year by 2021. In 2025, most exploited vulnerabilities were weaponized within three weeks.

AI Scanners Show Critical Inconsistency

Contrast Security tested the reliability of AI-powered security scanners. The company set three different AI scanners on the same codebase and found they agreed on only 5 percent of their findings. Running a single scanner three times against identical code reproduced just 17 percent of its own findings.

The financial cost of using these tools is significant. Scanning a 2-million-line codebase with AI tools cost approximately $315 in API charges. The subsequent triage of the findings cost around $128,000.

David Lindner, CISO at Contrast Security, noted the tools' fundamental limitations. "These tools disagree with each other; they disagree with themselves from one run to the next, and none of them can tell me how my application behaves when someone is actually attacking it," he said. Lindner warned this becomes a major problem when AI output becomes the primary guide for security team priorities.

Severity and Exploit Data Often Conflict

Common vulnerability scoring systems do not always align with real-world exploit activity. Among CVEs on CISA's Known Exploited Vulnerabilities list in the dataset, 82 percent had an Exploit Prediction Scoring System (EPSS) score of 90 percent or higher.

However, the data also included two CVEs, CVE-2006-1547 and CVE-2023-38180, each with a CVSS score of 7.5 but EPSS scores under 25 percent. Both were confirmed as exploited in the wild, demonstrating a disconnect between theoretical severity and practical threat.

Attack volumes vary widely. Over 60 percent of applications see fewer than 3,000 attacks per month. Yet, more than a quarter endure upwards of 30,000 attacks monthly.