ArmorCode surveyed 200 senior security and technology leaders, most at companies with 10,000 or more employees, and just over half said their organizations will struggle to simplify software security if they keep working the way they do today. The bottleneck is the post-scan workflow: someone must decide whether a finding matters, find the owner, and push the fix through teams that run on different tools and release schedules. Verizon's 2026 Data Breach Investigations Report puts the median time to fully resolve a critical vulnerability at 43 days.
AI is adding pressure from both sides. Forty percent of respondents picked the amount of AI-generated code waiting for human review as their most significant software-security challenge, though the single-choice format means the figure doesn't show how the other 60% rate it. A separate 44% named a tiered strategy for AI-assisted vulnerability discovery as the biggest transformation need. ArmorCode's Rob Chapman describes a layered approach: automation handles deterministic, repeatable work; AI agents investigate reachability, exploitability, and attack paths under guardrails; and humans own decisions, risk acceptance, and exceptions.
The top worry is a flood of low-context alerts—warnings that flag a weakness without saying whether it is reachable, exploitable, or tied to a business service. The leading goal is better remediation across security and development teams, since each handoff between scanners, security, and developers costs context and time. Chapman advises consolidating tools that overlap and produce undifferentiated findings, keeping tools with unique coverage, and connecting the rest through a shared layer. For the board, he recommends tracking time to remediate meaningful, exploitable, and exposed systems, plus visibility into where support is needed across teams, assets, and business units.