81% of CISOs and AppSec executives are willing to pivot to new MCP protection tools.

55% of CISOs and AppSec executives are willing to replace RASP.

52% of CISOs and AppSec executives are willing to replace SCA.

49% of CISOs and AppSec executives are willing to replace SAST/DAST.

Over 75% of security professionals do not have the real-time production insight necessary to validate risk and understand how their code behaves in real-world environments.

Malicious web application and API transactions rose 128% year over year.

72% of organizations experience at least one mobile app security incident in the past year.

91% of mobile app developers and security leaders prefer security that spans the entire software development lifecycle.

63% of mid-sized AppSec teams (11–50 members) that use SCA cite the inability to verify if vulnerabilities are exploitable in production as their biggest pain point.

38% of small AppSec teams (1–10 members) that use SCA cite the inability to verify if vulnerabilities are exploitable in production as their biggest pain point.

58% of large AppSec teams (50 members or more) that use SCA cite the inability to verify if vulnerabilities are exploitable in production as a major pain point.

13% of CISOs and AppSec executives use agent-based deployment.

16% of CISOs and AppSec executives want to consolidate the AppSec toolchain into one platform.

14.5% of AI agent configuration files grant arbitrary code execution permissions for Python.

14.4% of AI agent configuration files grant arbitrary code execution permissions for Node.js.

Almost 20% of developers let AI automatically save changes to the project's main code repository without human review.

Use of risk-ranking methods to determine where LLM-generated code is safe to deploy increased by 12%.

Establishment of standardized technology stacks rose by more than 40%.

Teams using attack intelligence to track emerging AI vulnerabilities increased by 10%.

Automated verification of infrastructure security surged by more than 50%.