Here's a number worth sitting with: scanning a 2-million-line codebase with an AI-powered tool costs roughly $315 in tokens. Triaging what that scan finds costs $128,000. That 400x gap, buried in Contrast Security's new AppSec Overflow 2026 report, is a sharper indictment of "AI will solve your security backlog" than any headline vulnerability count. The scanning was never the expensive part. Making sense of what it found is.
Contrast's report draws on runtime telemetry from inside hundreds of thousands of production applications and APIs, giving it a vantage point most vendor research doesn't have: not what's theoretically vulnerable in a codebase, but what's actually being reached and exploited in live production. The headline framing is stark. "AppSec math is broken, and in 2026, AI is a massive contributing factor," the report states, and the numbers back that up from multiple directions at once.
The attack volume is relentless, but mostly noise
The average monitored application absorbs 11,382 attacks a month, roughly one every four minutes. That number sounds alarming until you break it down: 87.8% are automated probes, low-stakes reconnaissance that maps attack surfaces without doing harm. Another 11.9% are suspicious but unconfirmed. The number that actually matters is the remaining 0.4%, an average of 42 viable attacks per month per application, meaning Contrast confirmed the exploit reached and triggered real vulnerable code. No false positives in that category; runtime observation proves activation, not just exposure.
Untrusted deserialization leads the viable attack data at 27.5%, followed by path traversal at 20.1% and method tampering at 13.4%. SQL injection, despite being one of the most well-understood vulnerability classes in software, still shows up in the top five attack techniques across every industry vertical the report tracked, a reminder that "well documented" and "actually fixed" are very different things.
Why the find-and-fix model is structurally broken, not just slow
The average application carries 106 vulnerability findings in custom code, and while roughly 60% of those are informational noise, an average of 22 are rated high or critical. Teams are closing just 3.4 vulnerabilities per application per month, and the mean time to remediate a critical vulnerability sits at 92 days. Third-party code fares no better: 54% of the CVE instances Contrast observed in production are from vulnerabilities disclosed more than a year ago.
That gap matters more than it used to because the other side of the equation has collapsed. Third-party research the report cites, aggregated by Zero Day Clock across more than 83,000 CVEs, shows mean time-to-exploit dropping from 2.3 years in 2018 to effectively same-day in 2026. Independent data from VulnCheck backs the trend, finding 29% of exploited CVEs in 2025 were weaponized on or before the day the CVE was published. A 92-day patch cycle against a same-day exploitation window isn't a performance problem. It's a structural mismatch that faster patching alone can't close.
The AI scanning findings, and one claim worth a caveat
The report's most useful contribution isn't the vulnerability count, it's the honest accounting of what AI scanning tools actually deliver today. Beyond the $315-versus-$128,000 triage-cost gap, Contrast found that three different AI scanners analyzing the identical codebase agreed on only 5% of findings. A single scanner rerun three times against unchanged code reproduced just 17% of its own prior results. That's not a minor calibration issue; it's a fundamental reliability problem for any team trying to build a repeatable process around these tools. Contrast's own framing is blunt: "For now, it's making the hole a lot deeper."
Worth flagging separately: the report opens with a claim about Anthropic's Claude Mythos model reportedly discovering thousands of previously unknown zero-day vulnerabilities in production testing, including a flaw in OpenBSD that had survived 27 years of human review. This has circulated in several industry newsletters, but Contrast's own report is careful to caveat it: "Anthropic has not disclosed the time, accuracy and human effort that was required for their analysis, making it difficult for security leaders to make real risk assessments today." Treat the underlying capability claim as unverified, even as the broader trend it's illustrating, AI compressing vulnerability discovery timelines, is well supported by the report's own runtime data.
Why CVSS and EPSS alone will steer you wrong
The report's prioritization section is the most practically useful part for a working developer or architect. Generic CVSS base scores tend to inflate perceived risk because most organizations never layer in the local context the scoring system was actually designed to incorporate. EPSS, which predicts 30-day exploitation probability, correlates strongly with real-world exploitation, 85% of CVEs with an EPSS score above 94% are on CISA's Known Exploited Vulnerabilities list, but it isn't complete either. The report cites two confirmed-exploited CVEs with EPSS scores of 22.2% and 0.88% respectively, low enough that a pure EPSS-driven process would have deprioritized both.
Contrast's answer is reachability and exploitability analysis: does the vulnerable function actually execute, does untrusted data actually reach it, and is the application configured in a way that makes exploitation possible. That's a meaningfully different, more precise filter than severity scores alone, though it's also, unsurprisingly, exactly what Contrast's own runtime platform is built to provide. Worth reading that recommendation with the appropriate grain of salt given who's making it, even where the underlying logic holds up.
What this actually means for the average team
Strip away the vendor framing and the practical takeaway is straightforward: attack surface and vulnerability volume are both growing faster than patch cycles can absorb, generic severity scores aren't precise enough to prioritize effectively at that scale, and AI scanning tools, at least in their current form, are adding inconsistent findings to the pile faster than they're helping teams work through it. The report's own conclusion lands on runtime visibility, actually knowing which vulnerabilities are reachable and being actively targeted, as the lever that matters most. That's a reasonable read of the data, even from a company that sells exactly that capability.