DevSecOps Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen, Cybersecurity | Last updated: September 25, 2026 | License: CC BY 4.0
Axis Intelligence Research’s DevSecOps Control Gap Index (DCGI) reads 61.2 out of 100 in its baseline reading as of September 24, 2026 โ meaning that across six pipeline controls, measured across tens of thousands of applications and 947 audited codebases, most organizations fail more controls than they pass, with CI/CD integrity and dependency risk scoring worst.
Quick Answer
DevSecOps in 2026 has a detection surplus and a remediation deficit. Datadog finds 87% of organizations run at least one known-exploitable vulnerability in deployed services; Veracode finds 60% carry critical security debt. Axis Intelligence Research’s DCGI scores the pipeline gap at 61.2/100.
Key Findings
- Axis Intelligence Research’s DevSecOps Control Gap Index (DCGI) stands at 61.2/100 as of September 24, 2026, built from six weighted pipeline controls sourced from Datadog, Black Duck, Veracode and GitGuardian 2026 data.
- According to Axis Intelligence Research, 96% of organizations using GitHub Actions run at least one marketplace action not fully pinned to a commit hash, derived from Datadog’s 2026 finding that only 4% pin all of them.
- Axis Intelligence Research calculates that critical security debt rose 14 percentage points in two years, from 46% of organizations in 2024 to 60% in 2026, across three Veracode State of Software Security editions.
- The median application dependency sits 278 days behind its latest major version, a 29.3% worsening in one year by Axis Intelligence Research’s calculation from Datadog’s 2026 and prior-edition figures (215 days).
- GitGuardian detected 28,649,024 new hardcoded secrets in public GitHub commits in 2025, up 34%, and 64% of valid secrets leaked in 2022 were still valid when retested in 2026.
What Is the DevSecOps Control Gap Index (DCGI)?
The DevSecOps Control Gap Index (DCGI) is an Axis Intelligence Research composite that scores, from 0 to 100, how far the software pipeline sits from basic DevSecOps control coverage. Zero would mean every measured population passes every control. One hundred would mean every measured population fails every control. It covers six stages of the software delivery lifecycle โ build, dependencies, runtime, backlog, credentials and intake โ because a DevSecOps program is only as strong as its least-covered stage.
DCGI Components, Inputs and Weights
| Pipeline stage | Control failure measured | Input | Weight | Weighted points | Source |
|---|---|---|---|---|---|
| CI/CD integrity | Orgs that never pin any GitHub Action to a full commit SHA | 71% | 20% | 14.2 | Datadog, State of DevSecOps 2026 |
| Dependency risk | Codebases with a high-risk open source vulnerability | 78% | 20% | 15.6 | Black Duck, OSSRA 2026 |
| Runtime exposure | Deployed services with a known-exploitable vulnerability | 40% | 20% | 8.0 | Datadog, State of DevSecOps 2026 |
| Remediation backlog | Orgs carrying critical security debt | 60% | 20% | 12.0 | Veracode, SoSS 2026 |
| Secrets hygiene | Valid secrets leaked in 2022 still valid in 2026 | 64% | 10% | 6.4 | GitGuardian, State of Secrets Sprawl 2026 |
| Intake discipline | Orgs adopting library versions within one day of release | 50% | 10% | 5.0 | Datadog, State of DevSecOps 2026 |
| DCGI (baseline reading) | 100% | 61.2 | Axis Intelligence Research |
Formula: DCGI = (0.20 ร 71) + (0.20 ร 78) + (0.20 ร 40) + (0.20 ร 60) + (0.10 ร 64) + (0.10 ร 50) = 61.2
The four stages that sit directly on the path from commit to production carry 20% each. Secrets and intake discipline carry 10% each because their inputs describe narrower populations โ a specific set of retested secrets, and a behavior (early adoption) that raises exposure without being a vulnerability by itself.
Marcus Chen’s read: The number that surprises people is not the 61. It’s which stage drags it up. Runtime exposure, the stage every vendor dashboard is built around, is the best score on the board at 40. The worst two are the ones nobody pages on: a build system that pulls unpinned third-party code with production credentials in scope, and a dependency tree where 78% of audited codebases carry a high-risk flaw. The exposure is upstream of where most teams are looking.
How Many Organizations Run Exploitable Vulnerabilities in Production?
According to Datadog’s State of DevSecOps 2026 (published February 26, 2026), 87% of organizations have at least one known-exploitable vulnerability in a deployed service, affecting 40% of all services. Datadog sourced “known exploited” from the CISA KEV catalog, NIST, ExploitDB and GitHub Advisories, extracted in January 2026.
Exploitable Vulnerabilities by Language
| Language / runtime | Services with an exploitable vulnerability | Source |
|---|---|---|
| Java | 59% | Datadog, State of DevSecOps 2026 |
| .NET | 47% | Datadog, State of DevSecOps 2026 |
| Rust | 40% | Datadog, State of DevSecOps 2026 |
| All services | 40% | Datadog, State of DevSecOps 2026 |
Does Running an End-of-Life Runtime Raise Exposure?
Yes. Datadog finds 10% of services run at least one end-of-life (EOL) language or runtime version โ 23% in Go, 13% in PHP. Where an organization uses an EOL version, 50% of services in that language carry an exploitable vulnerability, versus 37% where no EOL version is in use.
Go’s high EOL share is a policy artifact as much as a hygiene failure: Datadog notes a Go release is supported for one year, a PHP release for four.
How Far Behind Are Application Dependencies in 2026?
The median dependency is 278 days behind its latest major version, up from 215 days in the prior edition, per Datadog. Axis Intelligence Research calculates that as a 29.3% worsening in one year: (278 โ 215) รท 215.
| Ecosystem | Median lag behind latest major version | Source |
|---|---|---|
| Java | 492 days | Datadog, 2026 |
| Ruby | 357 days | Datadog, 2026 |
| All ecosystems (2026 edition) | 278 days | Datadog, 2026 |
| All ecosystems (prior edition) | 215 days | Datadog, 2025 edition |
Does Deployment Frequency Affect Dependency Freshness?
It does, and it’s the most practical finding in this dataset. Services deployed less than once a month carry dependencies a median of 295 days behind; services deployed daily sit at 172 days. Axis Intelligence Research puts that at a 1.72ร lag ratio (295 รท 172). Deployment frequency โ a DORA delivery metric โ behaves like a security control.
Why Do Old Libraries Matter?
Datadog finds newer libraries carry fewer discovered vulnerabilities: on average 1.3 per service for libraries published in 2025, 1.9 for 2024 and 3.8 for 2023 (the 2023 spike traced largely to Spring Framework and Spring Boot CVEs).
Black Duck’s 2026 OSSRA, based on 947 commercial codebases across 17 industries, shows the long tail: 93% of codebases contain components with no development activity in two years, 92% contain components four or more years out of date, and only 7% of components in use are the latest version.
Marcus Chen’s read: Teams read “278 days” as a patching problem. It’s a release-cadence problem. The service that ships daily is dragged forward whether anyone schedules an upgrade or not; the one that ships quarterly accumulates a version gap until the upgrade becomes a project, and projects get deferred. If you want fresher dependencies, look at the deploy pipeline before you look at the scanner.
How Big Is the Open Source Vulnerability Load per Codebase?
According to Black Duck’s 2026 Open Source Security and Risk Analysis (OSSRA), the mean number of open source vulnerabilities per codebase rose 107% to 581 โ the first time in the report’s history the figure more than doubled in a year.
| OSSRA 2026 metric | Value | Source |
|---|---|---|
| Codebases with at least one vulnerability | 87% | Black Duck OSSRA 2026 |
| Codebases with a high-risk vulnerability | 78% | Black Duck OSSRA 2026 |
| Codebases with a critical-risk vulnerability | 44% | Black Duck OSSRA 2026 |
| Mean open source vulnerabilities per codebase | 581 | Black Duck OSSRA 2026 |
| Files per codebase, year-over-year | +74% | Black Duck OSSRA 2026 |
| Open source components per codebase, year-over-year | +30% | Black Duck OSSRA 2026 |
| Codebases with license conflicts | 68% | Black Duck OSSRA 2026 |
| Components entering outside package managers | 17% | Black Duck OSSRA 2026 |
That last row matters for SCA coverage: components that arrive as copy-pasted snippets, vendored code or AI-generated code don’t appear in a manifest, so manifest-based scanning does not see them.
How Often Do Software Supply Chain Attacks Hit Organizations?
Black Duck reports that 65% of organizations experienced a software supply chain attack in the past year. Of those attacks, 66% involved malicious packages built to harm users (typosquatting, social engineering) and 34% involved legitimate packages that were hijacked.
Datadog’s telemetry shows how the exposure opens: 50% of organizations adopt third-party library versions within a day of release โ 54% of JavaScript users and 55% of Python users. 32% use a public Docker image within a day of its creation and 12% a public AMI. And 1.6% of organizations using npm ran at least one malicious dependency in 2025, which Datadog notes may represent tens of thousands of organizations at npm’s scale.
| Early-adoption behavior | Share of organizations | Source |
|---|---|---|
| Library version used within 1 day of release | 50% | Datadog, 2026 |
| โ Python users | 55% | Datadog, 2026 |
| โ JavaScript users | 54% | Datadog, 2026 |
| Public Docker image used within 1 day | 32% | Datadog, 2026 |
| Public AMI used within 1 day | 12% | Datadog, 2026 |
| npm orgs that ran a malicious dependency (2025) | 1.6% | Datadog, 2026 |
Marcus Chen’s read: There’s a tension here that most advice skips. Stale dependencies accumulate CVEs; brand-new ones are where worms like Shai-Hulud land. The answer Datadog points to is a cooldown โ Dependabot, Yarn and pnpm all now support a minimum release age โ so you stay current without being first. A week of patience is the cheapest supply chain control available.
Are GitHub Actions a Supply Chain Risk?
Yes โ and the numbers are the weakest in this dataset. Per Datadog’s 2026 report, every organization using GitHub Actions uses at least one marketplace action, yet only 4% pin all marketplace actions to a commit hash and 71% never pin any action. GitHub’s own secure-use guidance states pinning to a full-length commit SHA is the only way to use an action as an immutable release.
| GitHub Actions practice | Share of organizations | Source |
|---|---|---|
| Use at least one marketplace action | 100% | Datadog, 2026 |
| Pin all marketplace actions to a commit hash | 4% | Datadog, 2026 |
| Leave at least one marketplace action not fully pinned | 96% | Axis Intelligence Research (100 โ 4) |
| Never pin any action | 71% | Datadog, 2026 |
| Use an unpinned marketplace action not managed by GitHub | 80% | Datadog, 2026 |
| Run a previously compromised action, unpinned | 2% | Datadog, 2026 |
GitGuardian’s analysis of machines compromised in the Shai-Hulud 2 attack adds the other half of the picture: 59% of compromised machines were CI/CD runners, not personal workstations.
Marcus Chen’s read: The tj-actions compromise didn’t need a zero-day. It needed a tag that moved and thousands of workflows that trusted it. A CI runner holds deploy keys, cloud tokens and signing material, and in most organizations it executes third-party code with less scrutiny than a laptop gets. Pinning by SHA is a one-line change per action. At 4% adoption, it’s the cheapest gap on the board.
How Many Secrets Leak Into Code Every Year?
According to GitGuardian’s State of Secrets Sprawl 2026, 28,649,024 new hardcoded secrets were detected in public GitHub commits in 2025, a 34% increase. Leaked secrets grew 152% from 2021 to 2025, against 98% growth in active public developers.
New Secrets on Public GitHub by Year
| Year | New secrets detected (rounded, millions) | Source |
|---|---|---|
| 2021 | 11 | GitGuardian, 2026 |
| 2022 | 14 | GitGuardian, 2026 |
| 2023 | 18 | GitGuardian, 2026 |
| 2024 | 21 | GitGuardian, 2026 |
| 2025 | 29 | GitGuardian, 2026 |
Are Internal Repositories Safer Than Public Ones?
No. GitGuardian finds 32.2% of internal repositories contain at least one secret, versus 5.6% of public repositories โ a 5.75ร gap by Axis Intelligence Research’s calculation, which GitGuardian rounds to 6ร. And 28% of secret incidents happen exclusively outside code repositories, in collaboration and productivity tools.
How Long Do Leaked Secrets Stay Valid?
This is the remediation number. Of valid secrets GitGuardian detected in 2022, 64% were still active when retested in 2026 โ meaning, by Axis Intelligence Research’s calculation, only 36% were rotated in four years. Long-lived secrets account for 60% of policy breaches, and 46% of critical leaked secrets have no validation checker, so validation-only triage misses them.
How Is AI-Assisted Coding Changing DevSecOps Risk?
Three primary datasets point the same direction:
- Code volume: Black Duck’s OSSRA 2026 records files per codebase up 74% and open source components up 30% year-over-year, which the report links to AI coding assistant adoption.
- Credential leakage: GitGuardian finds Claude Code co-authored commits leak secrets at roughly 2ร the baseline across public GitHub commits; secrets for AI services rose 81% to 1,275,105 exposed; and 24,008 unique secrets sat in MCP configuration files.
- Breach surface: IBM’s Cost of a Data Breach Report 2026 finds more than 20% of organizations reported a breach targeting AI models or applications, with compromised APIs, applications or plug-ins the leading cause at 27%.
Marcus Chen’s read: Read GitGuardian’s 2ร carefully. It’s a rate on a specific tool’s commits, and GitGuardian itself says the human factor remains critical. What the data supports is narrower and more useful: AI tooling increases the number of credentials, config files and integrations per project faster than secrets management is being extended to cover them. The MCP config file is a new place for a Postgres connection string to live. Scan it like one.
How Much Security Debt Do Organizations Carry?
Veracode’s 2026 State of Software Security finds 82% of organizations carry security debt and 60% carry critical security debt, with high-risk vulnerabilities up 36% year-over-year. Veracode defines security debt as flaws left unresolved for more than a year; critical debt as flaws that are both high-severity and highly exploitable.
Security Debt Trend, 2024โ2026
| Edition | Orgs with security debt | Orgs with critical security debt | Source |
|---|---|---|---|
| 2024 | 71% | 46% | Veracode |
| 2025 | 74% | 50% | Veracode |
| 2026 | 82% | 60% | Veracode |
| Change 2024โ2026 | +11 pts | +14 pts | Axis Intelligence Research calculation |
Veracode’s compliance edition adds that the median flaw fix half-life is 243 days, third-party flaws take 358 days on average to fix, and 66% of critical security debt traces to third-party components โ which lines up with Black Duck’s dependency data from a different measurement angle.
How Many “Critical” Vulnerabilities Actually Matter?
Two vendors measure this differently, and we publish them side by side rather than merging them:
| Measure | Value | Method | Source |
|---|---|---|---|
| Critical dependency vulns that stay critical after runtime + exploit context | 18% | CVSS adjusted for production exposure, EPSS and exploit availability | Datadog, 2026 |
| Flaws posing real-world danger | 11.3% | Severe and highly exploitable, across 1.6M applications | Veracode, 2026 |
Different populations, different definitions โ but both land between roughly one in five and one in nine. Datadog’s per-language split is sharper still: 98% of .NET critical dependency vulnerabilities get downgraded, while 49% of PHP ones stay critical. Its average count of high or critical vulnerabilities per affected application fell to 8 from 13.5 the prior year.
Marcus Chen’s read: Security debt isn’t a scanner failure. Detection improved; fix capacity didn’t. When 60% of organizations sit on critical debt and the median flaw takes 243 days to reach half-life, the constraint is triage. Teams paging on raw CVSS are spending their fix budget on the 80%+ of “criticals” that context would have downgraded.
Why Does DevSecOps Matter for Breach Risk?
The 2026 Verizon Data Breach Investigations Report finds 31% of breaches now start with the exploitation of software vulnerabilities, overtaking stolen credentials as the top initial access vector. Ransomware is present in 48% of breaches.
On cost, IBM’s 2026 Cost of a Data Breach Report, based on 602 organizations, puts the global average breach at $4.99 million and AI-enabled breaches at $6 million. Only 18% of organizations apply AI agents to vulnerability management, even as more than half use them for threat detection.
For scale context: the public CVE program published 48,185 CVEs in 2025, per CVE data analysed by Cisco’s Jerry Gamblin and reported by The Stack.
Frequently Asked Questions
Should a CI/CD pipeline block a build on every critical CVE?
Per Datadog’s 2026 data, only 18% of critical dependency vulnerabilities remain critical after accounting for production exposure, exploit availability and EPSS. Blocking on raw CVSS alone gates builds on the other 82%. A context-aware policy (reachable, internet-facing, exploit available) cuts alert volume by more than 80%.
Is pinning GitHub Actions to a version tag enough?
No. GitHub’s documentation states that only a full-length commit SHA makes an action immutable; tags can be moved, which is how the tj-actions compromise spread. Datadog finds 71% of organizations never pin any action by SHA.
What cooldown period should we set for new dependency versions?
Datadog’s 2026 analysis indicates a cooldown of one week could prevent most malicious dependencies from taking root. Dependabot, Yarn and pnpm support a minimum release age. 50% of organizations currently adopt new library versions within a day.
Do private repositories need secret scanning?
Yes โ more than public ones. GitGuardian finds 32.2% of internal repositories contain at least one hardcoded secret versus 5.6% of public repositories, and 28% of secret incidents occur only in tools like Slack or Jira.
Does rotating leaked secrets actually happen?
Rarely. Of valid secrets GitGuardian detected in 2022, 64% were still valid in 2026. Rotation, not detection, is the bottleneck, because teams fear breaking production.
Which languages carry the most dependency risk in 2026?
Java: 59% of Java services have a known-exploitable vulnerability and Java dependencies lag a median 492 days behind their latest major version (Datadog, 2026). PHP has the highest share of critical vulnerabilities that stay critical after context, at 49%.
Does deploying more often improve security?
The data says yes for dependency freshness: services deployed daily have dependencies a median 172 days behind, versus 295 days for services deployed less than monthly โ a 1.72ร gap by Axis Intelligence Research’s calculation (Datadog, 2026).
How does the EU Cyber Resilience Act connect to these numbers?
Black Duck ties its maintenance findings โ 93% of codebases with components inactive for two years โ to CRA readiness, since abandoned components have no maintainer to ship fixes. Veracode’s compliance edition maps its 243-day median fix half-life against DORA, NIS2 and PCI DSS v4.0 obligations.
Methodology
Collection. Axis Intelligence Research fetched and read each primary report or official release between September 24, 2026 and publication: Datadog State of DevSecOps 2026 (telemetry from tens of thousands of applications), Black Duck OSSRA 2026 (947 codebases, 17 industries), GitGuardian State of Secrets Sprawl 2026 (public GitHub commits, enterprise deployments, Shai-Hulud 2 machines), Veracode State of Software Security 2026 (1.6 million applications) and its compliance edition, the Verizon 2026 DBIR, and IBM’s 2026 Cost of a Data Breach Report (602 organizations). Figures are reported at the precision each source published.
Axis calculations. Every derived figure shows its formula inline and is flagged axis_calculated = yes in the CSV:
- DCGI = ฮฃ(component ร weight), weights 0.20 ร 4 and 0.10 ร 2 โ 61.2
- Actions not fully pinned = 100% โ 4% = 96%
- Dependency lag change = (278 โ 215) รท 215 = 29.3%
- Deploy-cadence lag ratio = 295 รท 172 = 1.72ร
- Critical debt change = 60 โ 46 = 14 percentage points
- Secrets rotated = 100% โ 64% = 36%
- Internal vs public repo secret prevalence = 32.2 รท 5.6 = 5.75ร
How to read the DCGI. Its six inputs describe different populations (organizations, codebases, services, secrets), so the index measures breadth of control failure across the pipeline rather than the probability that any single organization is breached. Readings will be recomputed as each source publishes its next edition; component weights stay fixed so readings remain comparable.
About This Dataset
The dataset behind this page โ 109 rows covering exploitable-vulnerability prevalence, dependency lag, supply chain behavior, GitHub Actions pinning, secrets leakage, security debt and breach context, plus every DCGI component โ is available as devsecops-statistics.csv. Each row carries its value, unit, as-of date, source organization, document, URL, retrieval date, primary-source flag and, for Axis calculations, the formula. It is also published on Hugging Face, Kaggle and GitHub under CC BY 4.0.
How to Cite This Page
APA: Axis Intelligence Research. (2026, September 24). DevSecOps statistics 2026: CI/CD, supply chain, secrets & security debt data. Axis Intelligence. https://axis-intelligence.com/devsecops-statistics/
MLA: Axis Intelligence Research. “DevSecOps Statistics 2026: CI/CD, Supply Chain, Secrets & Security Debt Data.” Axis Intelligence, 24 Sept. 2026, axis-intelligence.com/devsecops-statistics/.
Chicago: Axis Intelligence Research. “DevSecOps Statistics 2026: CI/CD, Supply Chain, Secrets & Security Debt Data.” Axis Intelligence, September 24, 2026. https://axis-intelligence.com/devsecops-statistics/.