Sonatype has published research analysing four years of enterprise software development data, finding that the average application now carries 4.31 times more Critical and High-severity vulnerabilities than it did before 2022. The number of newly affected component versions is growing at 46 times the rate seen before March 2024.
The counterintuitive element in the data: remediation is improving. The median age of unresolved Critical and High vulnerabilities has fallen 59% over the same period. Teams are fixing problems faster. But application creation has accelerated by 4.84 times, generating a larger surface area of risk faster than the remediation improvements can absorb.
"AI is changing the math of software development. We're building more software, faster, but we're also introducing risk faster than traditional security processes can absorb it," said Brian Fox, Co-founder and CTO of Sonatype and Steward of Maven Central. "The answer can't be to put another review step at the end. We need to make better decisions at the moment software is assembled, whether that decision is being made by a developer or an AI agent."
The research surfaces one particularly concrete finding: in Maven Central, 62.2% of vulnerable dependency selections were made when a lower-risk version was already available. The risk was not inevitable — it was a selection decision made at assembly time, without adequate visibility.
Sonatype is accompanying the research with new product capabilities: Agent P, which automates software maintenance across human-led and AI-assisted workflows, and Security Events, which surfaces real-time intelligence about incidents affecting development. Both are additions to Sonatype Guide, the company's intelligence layer for AI-speed software development.
The report, titled The AI-Era Software Assembly Line, makes a structural argument: as AI agents participate in software assembly at scale, the decision point where risk is introduced is moving earlier in the development lifecycle, and current tooling was not built to govern at that speed.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
