The state of DevSecOps: Why upgrading your AppSec tooling is essential

The report surveys recent research on DevSecOps and AppSec, finding that organizations face alert fatigue, overreliance on legacy SAST, and limited adoption of runtime-aware tools like SCA/RASP, which hampers effective prioritization and remediation. It argues that shift-left alone is insufficient and advocates for modernized tooling—especially runtime-context prioritization, complex/binary composition analysis as a final “pre-deploy exam,” lightweight/distroless containers, and actionable, automated SBOMs—to reduce false positives, manage software complexity, and strengthen software supply chain security.