Study Finds 87% of Organizations Exposed to Attacks Due to Known Vulnerabilities

The 2026 State of DevSecOps report documents pervasive software supply-chain and CI/CD security risks: 87% of organizations run services with known exploitable vulnerabilities, the median third‑party dependency is 278 days behind, half of organizations adopt new libraries within 24 hours, and 71% do not pin GitHub Action SHAs—together creating large-scale exposure to malicious packages and compromised workflows; recommended mitigations include dependency cooldowns, using trusted container tags, pinning actions to commit SHAs, and prioritizing vulnerabilities by runtime exploitability.