Sonatype warns AI is speeding software risk growth

Sonatype has released research showing that the average enterprise application now contains 4.31 times more critical and high-severity vulnerabilities than four years ago, based on four years of enterprise software development data.

The research also found that organisations are creating far more software, with average monthly enterprise application creation rising by 4.84 times. At the same time, newly affected component versions are growing at 46 times the rate seen before March 2024, indicating that incoming software risk is rising faster than remediation efforts.

Even so, security teams are resolving known issues more quickly. The median age of unresolved critical and high vulnerabilities has fallen by 59%, suggesting that while teams are reducing backlog, they are still contending with a larger, faster-growing stream of exposure.

Much of the report focuses on the early stages of software assembly, when developers and automated systems choose third-party components and dependencies. According to the research, 62.2% of vulnerable dependency selections in Maven Central were made even though a lower-risk version was already available at the time.

These figures point to a problem earlier in the development process, not just at the point of remediation. As organisations produce more applications, each project brings fresh dependency choices and increases the number of potential attack surfaces, leaving security teams to manage a broader set of risks.

Sonatype linked the pattern to the growing use of AI-assisted development, saying it is increasing the speed of software creation beyond what traditional review processes were designed to handle. It argues that security decisions need to move closer to the point where software components are first selected.

"AI is changing the math of software development. We're building more software, faster, but we're also introducing risk faster than traditional security processes can absorb it," said Brian Fox, Co-founder and CTO, Sonatype.

"The answer can't be to put another review step at the end. We need to make better decisions at the moment software is assembled, whether that decision is being made by a developer or an AI agent," Fox said.

Alongside the research, Sonatype introduced new features for its Sonatype Guide product, including Agent P, a tool intended to automate software maintenance tasks, and Security Events, which provides a real-time view of incidents affecting development work.

Guide is intended to apply organisational policy when developers or AI systems select components, covering vulnerabilities, malware, licences and component quality. Security Events is designed to bring together information on open source vulnerabilities and malicious package incidents so teams can assess impact and respond more quickly.

Agent P is aimed at dependency management, upgrading components, validating changes and addressing compatibility issues before developer review. It is intended to reduce manual rework by turning maintenance tasks into proposed code changes ready for review.

Upstream controls

The broader argument behind the product update is that software risk should be handled earlier, before insecure or outdated components are built into applications. That approach reflects a wider shift in software security, as companies seek to reduce exposure during development instead of relying mainly on checks near release.

For large organisations, the issue has become harder to manage because modern applications often rely on extensive open source dependency chains. A single application can involve hundreds of component decisions, and the speed of AI-assisted development can multiply those choices across teams and projects.

Sonatype's findings suggest many of those decisions are avoidable sources of risk. If lower-risk versions were already available in more than six in ten vulnerable selections tracked through Maven Central, then better visibility at the moment of choice could reduce later remediation work.

That, in turn, has implications for software governance. Security teams have often relied on scanning, ticketing and patching after components are already in use, but growth in application volume and newly affected component versions may make that model harder to sustain on its own.

"Developers shouldn't have to choose between moving at AI speed and understanding the software they're bringing into the organisation," said Mitchell Johnson, Chief Product Development Officer, Sonatype.

"Guide brings the intelligence, policy, and automation together so human and agentic teams can make those decisions in the flow of development," Johnson said.