Study Finds 87% of Organizations Exposed to Attacks Due to Known Vulnerabilities

The 2026 State of DevSecOps report highlights a significant tension between development speed and security. Organizations are increasingly adopting AI-assisted coding but often neglect proper dependency management, leaving their software supply chains vulnerable to threat actors.

Threat Vector Key Metric Security Impact

Deployed Services 87% of organizations have known vulnerabilities. High risk of active exploitation.

Outdated Dependencies Median dependency is 278 days behind. Accumulation of unpatched security flaws.

Rapid Updates 50% use libraries within 1 day of release. Exposure to malicious supply chain packages.

CI/CD Pipelines 71% never pin GitHub Action hashes. Vulnerable to compromised workflow actions.

According to DataDog research, 87% of organizations operate deployed services containing known exploitable vulnerabilities. These flaws impact 40% of all services. Java applications show the highest vulnerability rate at 59%, followed by .NET and Rust. Moreover, 10% of global services run on end-of-life runtime environments, with Go at 23% and PHP at 13%.

Developers face challenges in maintenance, with the median third-party dependency being 278 days behind its latest major update. Java and Ruby environments are particularly lagging. While delayed patching is dangerous, updating too quickly introduces supply chain threats. Half of all organizations adopt new third-party libraries within 24 hours of release.

Specifically, 54% of JavaScript and 55% of Python users install updates immediately. This rapid adoption exposes them to malicious package attacks, such as recent npm worms. Similar risks affect cloud infrastructure, with 32% of organizations deploying public Docker images and 12% using public Amazon Machine Images (AMIs) within a day of creation.

Continuous integration pipelines are susceptible to compromise. While every surveyed organization uses GitHub marketplace actions, 71% never pin these actions to a full-length commit SHA, leaving them vulnerable to malicious payloads. However, when runtime context and true exploitability are analyzed, only 18% of reported "critical" dependency vulnerabilities pose a genuine threat.

Attack Surface Recommended Mitigation Expected Outcome

Third-Party Libraries Implement a 7-day update cooldown period. Prevents installation of day-one malicious packages.

Cloud Images Use trusted first-party Docker Hub tags. Reduces risk of deploying compromised containers.

GitHub Actions Pin all action versions to full commit SHAs. Blocks automatic updates of compromised actions.

Alert Management Adjust CVSS scores using runtime context. Reduces critical alert volume by over 80%.

To secure modern pipelines, organizations must carefully balance update cadences. Implementing dependency cooldown periods, securing CI/CD workflows, and prioritizing vulnerabilities based on real-world exploitability will help maintain development speed without compromising security.

Based on reporting by GBHackers.