Three-Quarters of Firms Knowingly Ship Vulnerable Code

Why It Matters

The convergence of pervasive vulnerable code and AI‑driven exploitation raises the probability of rapid, large‑scale breaches, forcing enterprises to rethink development and supply‑chain security strategies.

Key Takeaways

• 75% of firms knowingly deploy vulnerable code, down from 81% last year
• AI-generated code cuts exploit time from 840 days to under two
• Verizon reports vulnerability exploits now cause 31% of breach entry points
• Only 28% of AI-using firms audit third‑party AI systems
• Just 35% have formal AI governance policies in place

Pulse Analysis

The prevalence of vulnerable code is no longer a niche concern; it has become a systemic risk amplified by AI‑generated software. Checkmarx’s data shows three‑quarters of firms still ship known flaws, while AI tools enable threat actors to locate and weaponize those weaknesses at unprecedented speed. The drop from 840 days to under two days for a typical exploit underscores a shifting threat landscape where traditional patch cycles are outpaced, prompting security teams to adopt continuous, automated testing and rapid remediation pipelines.

Supply‑chain exposure compounds the problem, especially in regions like the United Kingdom where 75% of businesses cite AI‑driven vendor risk as a top worry. QBE’s findings reveal a paradox: heightened anxiety coexists with limited action—only 28% of AI‑using firms assess third‑party AI, and just 35% have formal governance frameworks. This gap leaves organizations vulnerable to cascading attacks that originate from a single compromised supplier, magnifying the potential impact of a breach across entire ecosystems.

Industry leaders are responding by integrating AI governance into broader risk‑management programs. Best practices now emphasize mandatory code provenance checks, AI model validation, and contractual security clauses for vendors. As exploit times shrink toward minutes, the cost of a breach escalates, making proactive auditing and policy enforcement essential. Companies that embed AI oversight into their development lifecycles will be better positioned to mitigate fast‑moving threats and protect both their own assets and those of their partners.