Orca-State-of-AppSec-Report-2026.md

**2026 State of AppSec Report:** Leveraging telemetry from 1,000+ production organizations, the report finds pervasive application-security risk—78% run applications with critical vulnerabilities, 31% expose valid secrets, 43% expose AI/ML credentials, 50% remain vulnerable to Log4Shell, and 11% run known malicious packages—highlighting large-scale supply-chain campaigns (e.g., the Shai-Hulud self-replicating npm worm), slow remediation of container and dependency issues, and systemic CI/CD and IaC misconfigurations that scale risk into production.