Three-Quarters of Firms Knowingly Ship Vulnerable Code

## Executive summary Recent industry studies report that a large majority of organizations ship vulnerable code and that AI is dramatically accelerating time-to-exploit, with Checkmarx and Verizon data showing vulnerability exploitation as a rising initial access vector and QBE noting growing supply-chain AI concerns and limited third-party AI governance.