Datadog-State-of-DevSecOps-2026.md

Datadog's State-of-DevSecOps (2027) finds pervasive exploitable vulnerabilities (87% of organizations affected, 54% of services) and significant software supply-chain risks: rapid adoption of new releases enables malicious library and image abuse, GitHub Actions marketplace actions have been compromised and are rarely pinned by hash, and many organizations use public AMIs/Docker images within a day of publication. The report quantifies ecosystem lag (median dependency ~773 days behind), attack surface from unpinned CI actions, and recommends mitigations such as commit-hash pinning, cooldown windows, allowed AMIs, and context-aware vulnerability prioritization.