Most AppSec teams say they fix critical bugs. Data shows otherwise.

In Semgrep's report, Braden Riggs finds top teams fix 63% of critical issues, while most fix just 13%. Same tools and alerts—the gap is execution, not detection.

�� What 50k repos reveal about real vulnerability fixes → https://thehackernews.com/expert-insights/2026/03/which-code-vulnerabilities-actually-get.html