Veracode, Inc. - Experts & Thought Leaders

Veracode, the pioneer in application risk management, announces a jump from 56 percent to 62 percent in overall AI-generated code security, alongside a drop in vulnerabilities from 44 percent to 38 percent — the most significant improvement since the GenAI Code Security Report series began in July 2025. Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol co-lead the rankings at 73 percent, surpassing the previous high of 68 percent set by GPT-5.5 in July 2026. “We’ve been analyzing code generated by multiple LLMs for more than a year. Until now, we have not seen a marked improvement in AI code security, despite consistently near-perfect functionality,” said Chris Wysopal, Co-founder & Chief Security Evangelist at Veracode. “This is the first time since running our study that we’ve been able to report a meaningful move on the security dial. Ten models now clear 60 percent, up from four in the last report, and the overall average has jumped six percentage points. With around half of code now generated by AI, today’s results are truly encouraging.”  Meaning vulnerability volume Veracode tested 18 models across four languages (Python, C#, JavaScript, Java) and four Common Weakness Enumeration (CWE) categories (CWE-89, CWE-327, CWE-80, CWE-117). Claude Opus 5.5 and GPT-6-Sol tied at 73 percent, dethroning GPT-5.5, which led the summer 2026 snapshot at 68 percent. Anthropic and OpenAI each have models in the top seven. In July, six of 11 models sat between 50 and 53 percent; today only two remain in that band, while 10 clear 60 percent. The floor hasn't moved, however, with the bottom still at 44–50 percent, meaning vulnerability volume still depends on model selection. Data-flow reasoning Vulnerability type CWE-80, cross-site scripting (XSS), was the main driver of the overall gain. Despite being one of the weaker categories, XSS rose to 18 percent, in contrast to its modest uptick demonstrated in July’s analysis. This represents the single biggest shift in the dataset. Meanwhile, crypto (CWE-327) held at 87 percent, Structured Query Language (SQL) injection (CWE-89) held at 84 percent, and log injection (CWE-117) remained flat at 13 percent. The reason is structural: XSS is the easiest vulnerability to fix through pattern recognition, which is exactly how LLMs improve. Log injection requires data-flow reasoning across multiple functions, where LLMs continue to stall. Highest security outcome The top-performing models carry premium compute costs. Performance also correlates with model size: large models average 55 percent versus 51 percent for small models, which reverses last year's finding that size had "essentially no effect" on security.  “The models that produce the most secure code are the ones that cost the most to run at scale, yet they still fail on more than one in four security tasks,” Wysopal said. “The answer should never be to use the most expensive model and hope for the best. A mid-tier model at a 60 percent pass rate plus Veracode scanning is more accurate, more cost-effective, and more scalable than a frontier model at 73 percent with no verification. Organizations must look for a combination of coding model, security testing, and remediation to get the highest security outcome.” Coding-specialized models General models pull further ahead of coding models. General-purpose models average 54 percent on security tasks versus 51 percent for coding-specialized models — a gap that has widened from one to three points since July.  Nearly four in 10 AI code tasks still produce vulnerable code. The rate of vulnerabilities dropped from 44 to 38 percent. This is meaningful but still means roughly four in 10 tasks produced vulnerable code without security-specific guidance. Java is still stuck. Java remains the dramatic outlier at 31 percent, barely up from 30 percent in July. The gap between Java and the other three languages (Python at 64 percent, C# at 60 percent, and JavaScript at 57 percent) is still 26–33 percentage points. Long-lived vulnerabilities The improvement is real but mends a small part of a larger wound. According to Veracode's 2026 State of Software Security report, 82 percent of organizations now carry security debt (vulnerabilities unresolved for more than a year). Moreover, 66 percent of the most dangerous, long-lived vulnerabilities come from third-party code, taking 358 days to fix on average. “Newer LLMs are producing more code that’s both functional and secure, but that does not mean we can start blindly trusting AI-generated code,” Wysopal closed. “The most effective strategy isn't chasing the most expensive model for marginal gains; it's combining AI code generation with continuous, independent security verification that catches what the models miss. That approach covers the full risk surface, from first-party code to third-party dependencies."

Veracode, a global pioneer in application risk management announced the acquisition of Longbow Security, a pioneer in security risk management for cloud-native environments. The acquisition marks the next exciting phase of Veracode, underscoring the company’s commitment to helping organizations effectively manage and reduce application risk across the growing attack surface. Automated issue investigation The integration of Longbow into Veracode enables security teams to discover cloud and application assets quickly and easily assess their threat exposure using automated issue investigation and root cause analysis. Longbow provides a centralized view of risk for cloud assets and applications, thereby simplifying complex workflows, enabling faster and more effective remediation, and improving overall security posture. The result is reduced risk and fewer vulnerabilities in applications and cloud infrastructures. Operational complexity Organizations require a deeper understanding of their risk profile within changing environments Increased adoption of cloud infrastructure, combined with developers taking on more responsibility for the creation, deployment, and security of software, has introduced operational complexity. Organizations require a deeper understanding of their risk profile within changing environments and a continuous security feedback loop throughout the software development life cycle. Comprehensive risk viewing “Security teams are drowning in alerts that lack sufficient detail on the level of business risk, degree of exploitability of a flaw, and specific code-level insight to keep pace with remediation requirements. As a result, risk continues to accumulate,” said Brian Roche, Chief Product Officer at Veracode. “With the combination of Veracode and Longbow, teams can get a comprehensive view of their risk, automate prioritization of what matters most, and, with Veracode Fix, automate remediation of code security flaws.” Simplifying Cloud Application Security With 71 percent of organizations shouldering the burden of “security debt” (flaws in applications that remain unfixed for one year), teams must act quickly to reduce their threat exposure. Yet, sufficient visibility and alert fatigue continue to plague cloud and application security professionals. With Longbow, Veracode customers can address these challenges in four ways: Unified visibility of risk across applications, code, and cloud. This gives teams insight into tackling significant issues that matter most to the business. Orchestrated remediation from code to cloud, enabling teams to prioritize and remediate with Veracode’s AI-driven fix capabilities. Actionable insights with ‘Best Next Action’ advice, so customers can conduct a root cause analysis and pinpoint the best path to remediation. Continuous monitoring and assessment via real-time vulnerability discovery across application portfolios and runtime environments, meaning customers know exactly what is running and where. Visibility, automation, and remediation capability Derek Maki, Co-Founder & Chief Product Officer at Longbow said, “We founded Longbow with a mission to simplify an increasingly complex application security risk management process and help organizations reduce risk at scale." "By joining forces with Veracode, our combined solutions provide unmatched visibility, automation, and remediation capability for security and engineering teams. We are excited to take cloud-native application security to the next level.” Application security posture management “This is the perfect fit for Longbow,” said Dayne Myers, Co-founder & Chief Executive Officer of Longbow. “After careful consideration, we believe that our technology and team align seamlessly with Veracode's vision, making this the best choice for Longbow’s future." “We’re thrilled to welcome Longbow to Veracode and expand our platform capabilities with industry-pioneering application security posture management for today’s enterprise requirements,” closed Sam King, Chief Executive Officer at Veracode. Holistic application risk management platform “The integration of our solutions provides organizations with a holistic application risk management platform that spans code to cloud." "Veracode combined with Longbow advances the field of application security and enables customers to secure their increasingly complex application landscape more efficiently.” Longbow is available immediately.

Veracode, a global provider of intelligent software security, has released research indicating applications developed by organizations in Europe, the Middle East, and Africa tend to contain more security flaws than those created by their U.S. counterparts.  Across all regions analyzed, EMEA also has the highest percentage of ‘high severity’ flaws, meaning they would cause a critical issue for the business if exploited. High numbers of flaws and vulnerabilities in applications correlate with increased levels of risk, which is particularly notable as software supply chain cyberattacks dominate headlines in 2023. Application lifecycle Researchers found that just over 80 percent of applications developed by EMEA organizations had at least one security flaw detected in their most recent scan over the last 12 months, compared to just under 73 percent of U.S. organizations. In addition, the percentage of applications containing ‘high severity’ flaws was the highest of all regions, at almost 20 percent. Percentage of applications containing ‘high severity’ flaws was the highest of all regions, at almost 20%  "Our data shows that organizations globally are continuing to deploy a worrying number of applications with a high number of flaws in the CWE Top 25,” said Chris Eng, Chief Research Officer at Veracode, adding “We did, however, identify interesting regional differences, particularly in terms of third-party or open-source code usage and the ways in which vulnerabilities are introduced across the application lifecycle.” EMEA-specific findings Analysis of data collected from more than 27 million scans across 750,000 applications helped to produce Veracode’s latest annual report on the State of Software Security. This new report showcases the EMEA-specific findings from those scans and applications, including results from the UK, Germany, France, Italy, and across the Middle East and Africa. Numbers alone don’t convey the consequences of hackers exploiting software vulnerabilities. With organizations across EMEA utilizing an ever more complex mix of third-party software to deliver their services, the exploitation of a serious vulnerability can impact thousands of victims at once. Earlier this year, a vulnerability affecting printing software tools PaperCut MF and PaperCut NG was actively abused by threat actors. Up to 70,000 organizations in 200 countries became potential victims, and law enforcement reports found threat actors successfully compromised vulnerable entities in the education sector.  Java and Third-party Code Introduce Significant Security Flaws  Java usage is a key factor in the higher percentage of vulnerabilities introduced into applications in region The research identified notable regional differences in preferred language usage, with Java revealed to be the preferred language for developers in EMEA. Teams using Java were found to remediate flaws at a slower rate than those using .NET or JavaScript, causing many of these flaws to persist or remain undiscovered for significantly longer.  Moreover, as over 95 percent of Java applications are comprised of third-party or open-source code, Java usage is a key factor in the higher percentage of vulnerabilities introduced into applications in the region. This highlights the importance of software composition analysis (SCA), which picks up flaws in open-source code, and the research found a higher proportion of flaws reported by SCA in EMEA than in other regions. Public GitHub repositories As generative AI continues to gain strong traction in software development, the risk of vulnerabilities from external sources increases. A study, presented at Black Hat in 2022, showed vulnerabilities in 40 percent of code that had been written by large language models trained on vast troves of unrefined data, including millions of public GitHub repositories. It is, therefore, vital organizations leverage SCA tools to find and fix flaws, empowering developers to take advantage of AI without compromising the security of applications.  Applications Become More Vulnerable Over Time  Overall, the baseline chance that a flaw will be introduced in any given month was 27 percent The research also showed new flaws continue to be introduced into EMEA applications at a far higher rate across the entire application lifecycle than in other regions. While EMEA organizations kept updating applications, there was less of a focus on quality. After a five-year timespan, 50 percent of applications in EMEA continue to introduce new flaws, compared to just over 30 percent for the rest of the world. Overall, the baseline chance that a flaw will be introduced in any given month was 27 percent.   As such, EMEA organizations would benefit from paying more attention to the latter portion of the application lifecycle and scanning applications more regularly. They should also prioritize security training for developers, with the research finding completion of 10 interactive security labs reduces the probability of flaw introduction from 27 percent to about 25 percent in any given month. State of Software Security report “This year’s State of Software Security report shines a light on the importance of security across the entire software lifecycle, as well as the urgent need to address risks posed by third-party and AI-generated code,” said Chris Eng, adding “While across the board globally we are still seeing a concerning volume of vulnerabilities, these figures are higher in EMEA across almost all measurements. Development teams in this region must take the opportunity to automate software security for regular scanning, and carefully consider their use of AI tools, both to increase security and empower developers.”  The Veracode State of Software Security EMEA 2023 recommends four actions software development teams can take to improve their cybersecurity posture.