How this issue is different
For this special issue, we stepped back from incidents, vulnerabilities, and product launches and looked ahead. We reviewed a small set of 2026 predictions written by experienced security operators and builders across AppSec, platform security, and product security.
The goal was not to repeat predictions, but to extract the shared signals underneath them and translate those into practical implications for AppSec teams heading into 2026.
The perspectives synthesized here draw from recent writing by senior practitioners, including insights from Nick Reva, Frank Wang, and James Berthoty, along with additional industry studies and independent analysis.
The AppSec signals that matter in 2026
Across very different viewpoints, a clear pattern emerged. Security is moving earlier, becoming more automated, and more tightly coupled to product and platform decisions. The following themes showed up consistently.
1. Non-human identity becomes a primary attack surface
Service accounts, access keys, tokens, agents, and AI-driven workflows are exploding in number.
These identities are long-lived, poorly inventoried, and often invisible to traditional IAM programs.
Agentic systems dramatically worsen identity sprawl by default.
Discovery efforts routinely surface unsanctioned AI usage embedded directly in production environments.
What this means for AppSec: Identity risk is no longer just a cloud or IAM concern. AppSec teams need visibility into non-human identities at both design time and runtime, and governance must be treated as a product architecture issue rather than a policy exercise. Multiple vendors are actively addressing this gap, including startups like Keycard and Formal, as well as established players such as SailPoint and Okta, which are continuing to innovate in this space.
2. AI-driven attacks shift from novelty to baseline
AI-assisted attacks are already operating continuously, not experimentally.
Many campaigns remain undetected because they do not resemble historical attacker behavior.
Automated attackers adapt faster than human-paced defenses and operate without downtime.
What this means for AppSec: Threat models must assume adaptive, always-on adversaries. Controls and detections designed around human timelines will increasingly fall short. Design reviews should explicitly account for AI-instrumented abuse paths, not just traditional misuse cases. If you want to go deeper, Malika Aubakirova explores how AI is reshaping penetration testing in a recent article published by Andreessen Horowitz.
3. Agentic security tools settle into an augmentation role
The narrative of fully autonomous security operations is cooling.
The real gains come from accelerating speed to context, triage, and correlation.
Even small improvements in context gathering materially improve incident response outcomes.
What this means for AppSec: The winning approach is augmentation, not replacement. Agentic systems should reduce low-judgment work, enrich signals, and help humans move faster with better information, especially during incidents and design reviews.
This perspective was echoed by Adam Shostack stack in his recent keynote at OWASP Global AppSec, where he emphasized using automation to improve decision quality and speed rather than attempting to automate judgment itself.
4. Security design reviews become AI-assisted by default
Manual threat modeling and design review do not scale with modern development velocity.
Generic LLMs lack the organizational, architectural, and code context needed to be useful.
Purpose-built systems that understand internal systems are gaining traction.
What this means for AppSec: Design review is evolving from a gate to a continuous capability. AppSec teams should embed threat modeling earlier in the lifecycle and prioritize tools that understand real system context rather than generic patterns.
5. Secure-by-default moves further upstream
Attacks on developer environments and supply chains have proven highly effective.
Traditional “shift left” approaches are insufficient when developer tooling itself is compromised.
Dependency sourcing, package managers, and developer workflows are becoming security boundaries.
What this means for AppSec: Security constraints are moving into the developer experience itself. Teams should focus on hardened defaults, tighter dependency controls, and defense-in-depth mechanisms that activate before code ever reaches CI or production. Startups like Socket and Seal Security are good examples of how secure-by-default workflows are being built into everyday development practices.
6. Economic pressure sharpens prioritization
Budgets are tighter and scrutiny is higher.
Security investments must map clearly to risk reduction and business outcomes.
Coverage without prioritization is losing favor.
What this means for AppSec: Context-driven prioritization matters more than ever. Teams that can tie design decisions, threat models, and controls to real exposure will outperform those chasing theoretical risk.
Closing signal
The throughline across all these predictions is not more tooling. It is earlier context, stronger defaults, and tighter integration between security, engineering, and product.
The software development lifecycle is fundamentally changing. The traditional linear pipeline is giving way to a more iterative model where AI agents increasingly translate product requirements into code and deploy changes directly.
As a result, the AppSec stack is evolving rapidly, and practitioners should re-evaluate the ROI and relevance of their existing tools.
2026 will likely be the year when the “wait and see” approach to AI code generation gives way to action. In our conversations with software and security leaders across organizations of all sizes, the common thread is acceptance of AI-generated code and a push to establish secure guardrails around it.
New categories such as secure design are gaining momentum and moving toward the center of AppSec strategy, driven in large part by how AI-assisted development is reshaping how software is written. In 2026, proactive security is poised to become the new front line in AppSec.
Thanks for reading The AppSec Signal, DevArmor’s newsletter for security professionals. Have feedback or ideas for what we should cover next? Feel free to reach out - signal at devarmor dot com
