Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Enterprise software delivery is accelerating with more applications, more teams, more pipelines, more third-party code shipping faster than ever. And you can add the compounding risks of AI onto all of that. At the same time, compliance pressure is rising across development, security, and audit teams.

Public sector software, from defense platforms to K-12 student information systems, is accumulating a dangerous backlog of unresolved vulnerabilities. That’s the headline finding from Veracode’s 2026 State of Software Security report, and the data behind it is unambiguous: the pace of vulnerability discovery has structurally outrun the capacity to fix them.

This CISO application risk intelligence briefing covers two distinct horizons: the past seven days (Wednesday, 26 August 2026 through Wednesday, 2 September 2026) and the preceding thirty days (Sunday, 3 August 2026 through Wednesday, 2 September 2026). It is written for board risk committees and operating CISOs.

Veracode Research’s latest secure-coding test finds GPT-5.6 Sol with a 15-point Python gain beneath modest aggregate movement, evidence that cyber capability and secure-code generation do not move in lockstep. OpenAI calls GPT-5.6 Sol its “strongest cybersecurity model yet.” Veracode’s extension test finds it scoring only two percentage points higher overall on secure-code generation than GPT-5.5, but it scores 15 points higher in Python.

This executive intelligence briefing covers from the past week (19-26 August 2026) and the past month (approximately 27 July–26 August 2026). Exploit velocity has overtaken patch cadence as the binding constraint. VMware vCenter moved from Broadcom patch to mass exploitation in five days, and this week’s CISA KEV due dates are measured in 72 hours, not 30 days.

If you’re comparing software supply chain security vendors in 2026, the market can feel deceptively crowded. Many platforms now claim broad coverage. Many specialists still lead in critical niches. And nearly every vendor can produce a long feature checklist. That is exactly why buyer discipline matters more than ever.

This executive intelligence briefing covers two distinct horizons: the past week (12–19 August 2026) and the past month (approximately 20 July–19 August 2026). It prioritizes AppSec, software supply chain, state-actor activity, cloud/IaC, identity, ransomware resilience, and regulatory developments with board-level implications. Analysis focuses on residual risk, control effectiveness, and business enablement rather than volume metrics alone.

The amount of code being generated in the era of AI is staggering, and some non-trivial percentage of that code is insecure. According to the 2026 GenAI Code Security Report, roughly 44% of AI generated code test produced a known vulnerability. Organizations are more reliant than ever on cybersecurity programs that can scale at the velocity of AI while still managing risk with guardrails, governance, and compliance standards.

Veracode I have been going to Black Hat for more than 25 years, and I have spent many of those years on the Review Board. New technologies keep changing the shape of the systems we secure. The questions I find myself asking stay remarkably familiar. Where does untrusted data enter? What authority does a component have? Which boundary controls a sensitive operation? How do we know that control worked?

Many tools fail to adapt to diverse developer use cases, leading to workflow interruptions in IDEs and CI pipelines. Managing dependencies for multi-module projects can be complex and time-consuming, often causing delays. And developers frequently work across varied environments – whether it’s IDEs, CI pipelines, or repositories, each with unique requirements. These challenges create friction and slow down the development process, making it harder to deliver secure applications on time.