The AppSec bottleneck isn’t detection. It’s remediation

Effective March 27, 2026, HackerOne paused accepting new submissions to its Internet Bug Bounty program. Its explanation pointed to a growing imbalance: AI-assisted research is increasing the speed and coverage of vulnerability discovery, while open-source maintainers haven’t gained matching capacity to assess and remediate those findings.

The same imbalance shows up in enterprise AppSec. Teams already generate findings from source code, running applications, APIs, and open-source components. Adding more discovery without improving triage and AppSec remediation can produce a larger backlog rather than reduce risk.

More findings don’t automatically mean better security

Security improves when teams can determine which findings matter, route them to the right owners, and resolve them before they create risk in production. That’s why the operational question is shifting from “Can we find more?” to “Can we act on what we already know?”

Frontier AI models are accelerating this shift. Anthropic’s Project Glasswinggives selected...

Copyright of this story solely belongs to blogs.opentext.com. To see the full text click HERE