The AI Security Gap Hiding in Routine Maintenance

This blog was first published on November 9, 2026 at https://openssf.org/blog/2026/11/09/the-ai-security-gap-hiding-in-routine-maintenance/ and repurposed here with consent from the author.

Ask a security team what worries them about AI and you'll probably hear about supply chain attacks or prompt injection first. The Linux Foundation's new report, State of AI Impact on Software Security and Cybersecurity 2026, backs that up, with 93% of the security experts it surveyed concerned about supply chain attacks and 90% about prompt injection. Some of the report's most important findings, though, are about something a lot less dramatic: the everyday work of keeping software up to date.

LF Research surveyed 308 people working on security in companies and open source projects this summer, in research sponsored by OpenSSF, LF AI & Data, and ActiveState, where I'm CEO. Coming at it as an operator, I wasn't surprised by what they found, because every dependency a team adds comes with years of upkeep, and that work almost never gets staffed the way new features do.

Where teams feel least prepared

The survey asked practitioners how concerned they are about a long list of AI-related threats and how prepared they feel for each one, and for every single threat, concern came out ahead. The biggest gap was around automated exploit generation, which isn't surprising for such a new kind of threat. Right behind it, though, was something much more familiar, which is keeping up with component updates. 83% of practitioners said they're concerned about the extra maintenance that comes with a high volume of updates, but only 44% said they feel prepared for it, and 43% are already dealing with it today.

AI is adding to the pile

Part of the reason is that AI coding tools are adding dependencies. 60% of the organizations and projects in the survey said these tools have increased the number of external dependencies in their code (only 16% said the opposite), and teams review transitive dependencies, the packages your dependencies bring in with them, only about half the time. Meanwhile, 58% say they're shipping code faster than security review can keep up. I think AI is signing teams up for upkeep faster than most of them can hire for it, and these numbers are what that looks like in practice.

Why fixes wait

The report also asked why fixes get pushed back, and the top answer was the risk of breaking something (28%), followed by not having the time (22%). In my experience, that's exactly how backlogs build up. A team knows about the vulnerability and knows a fix exists, but the update might break something in production, so it waits for a better moment, and that moment can take a while to arrive.

Having someone own the problem helps. Among teams without a dedicated security team or role for AI threats, only 23% fix most new alerts right away, compared with 43% of teams that have one, and only 30% of teams have that kind of role at all. Everyone else is triaging, getting to the most severe alerts and leaving the rest to pile up into what the report calls security debt.

A question worth asking

If you're a CEO or engineering leader, here's a question worth bringing to your next security review: how much of our backlog is there because patching feels risky, and not because a fix doesn't exist? If the answer is a lot, more scanning won't help much, and you probably need a better way to keep components current.

The report has some good suggestions for where to start. Decide who owns AI security on your team, since teams with a dedicated role or a formal AI security policy felt better prepared for every threat in the survey (the report is careful to note that's a correlation, not proof). Cut the dependencies you don't really need, because, as the report puts it, "One less dependency means one less factor beyond the purview of the security team." And pull the ones you keep from a vetted, policy-governed source, so known-vulnerable code never makes it into the backlog in the first place.

The report's foreword asks readers to take one question back to their teams: "where is software development outpacing review, and who is responsible for closing that gap?" For a lot of teams, I suspect the answer starts with maintenance.

Continue the conversation at KubeCon

Visit ActiveState at booth (#277) to discuss practical approaches to managing open source dependencies and strengthening software security in the AI era.

About the Author:

Abby Kearns is CEO of ActiveState. She was previously CEO of the Cloud Foundry Foundation and CTO at Puppet.