September 24, 2026
0 mins readEvery security program has one: a queue of a few thousand findings, or a few hundred thousand, that nobody has worked through and nobody expects to. Most teams file it under technical debt, a cost carried on purpose, paid down when there is room, and tolerable because the interest rate stays low.
That accounting held for a long time, because it rested on a single assumption: almost nothing in the queue would ever be reached, or exploited, by anyone. As reasonable as that assumption was as an engineering decision, it has become the weakest part of the model.
The backlog was a bet
Developers have outnumbered security professionals for as long as both functions have existed. Under that constraint, triage was the right, and frankly only, call: prioritize the findings, set a severity threshold, work on what clears the bar, and accept the rest.
Accepting the rest amounted to a bet on exploitation probability, namely that an attacker would not find this specific medium-severity issue, in this specific service, before the code around it changed anyway. The findings were understood to be real, and the wager was that they would go untouched.
Programs still run the instruments of that bet: the risk register, SLA tiers, "won't fix" and "risk accepted" states, exception and waiver workflows, and severity floors below which nothing gets triaged at all. Each one exists because an organization made a rational compromise and needed machinery to operate it at scale.
Three inputs changed at the same time
A bet is only as good as the odds it was struck against, and three of those odds have moved.
1. Code arrives faster than any review cadence
Lines of code per developer are up 218%, with 62% of that code broken or insecure. As of June 2026, Snyk's own product data shows roughly six new vulnerabilities introduced for every one remediated, and agentic development keeps widening that ratio.
The direction matters more than the number, because inflow running six times ahead of outflow means the accepted remainder grows every sprint without anyone deciding to grow it. Every threshold, SLA, and staffing model in the program was sized against a different input rate, and none of them were renegotiated when the rate changed.
2. The code arrives without an author to ask
"Ask the author" is the oldest instrument in code review, and it has no counterpart when the author is an agent, because nobody chose the dependency, reasoned about the pattern, or can explain what the change was for.
Reviewers now approve code they did not write and cannot interrogate, so the reasoning that used to travel alongside a change has to be reconstructed from the change itself. Findings that a two-minute conversation would once have closed go into the queue instead, which raises inflow a second time for reasons unrelated to code volume.
3. Attackers automated their side
The probability bet was struck against human-speed reconnaissance, where enumerating a large surface cost an attacker real hours and returned mostly noise. Automation changed that math. Walking a wide surface, cataloging every weak signal, and testing combinations no analyst would have spent an afternoon on are all cheap now.
The consequence is specific, and so is the response. Every entry in your register was priced under the old odds, and most have not been re-examined since the day they were accepted, which makes re-pricing that register work you can scope and schedule this quarter.
Low-severity findings combine into high-severity paths
Severity scores a finding in isolation, while attacks combine findings.
Consider three entries that each sit comfortably below the triage line: an insecure direct object reference that leaks an internal object ID, a verbose error response that confirms when a guessed ID is valid, and an outdated serialization library with a known deserialization issue. Individually, each is the kind of finding a program accepts and never revisits. Chained, they form an authenticated path to remote code execution.
That mechanic is what turns a backlog into a surface. The queue functions as an inventory of components an attacker can assemble, and the assembly is the part that a severity model never scores.
The practical move is to read the register as a description of what an attacker has to work with. Ask which accepted findings sit in the same service, share a trust boundary, or touch the same data, because those clusters are where the exposure lives, and they stay invisible to any view that sorts by severity.
Prioritization orders the queue without shortening it
The instinctive response to a growing backlog is better ranking: score more precisely, weight by reachability, sort by exploitability, and work at the top of the list with more confidence.
Better ranking produces a better-ordered queue of the same length. Once inflow exceeds outflow, ranking determines which findings stay permanently unaddressed, which makes prioritization the instrument that administers accepted risk. Improving that instrument improves the administration of a state; the program should be leaving.
Reachability, exploitability, and fix-outcome history earn their keep elsewhere. Point them at fix correctness and clearing order, where they answer questions that move the number: will this fix address a real path, will it ship without breaking the build, and what clears first. Reaching zero depends on the rate, and ranking leaves the rate untouched.
What it takes to treat the backlog as a surface
Before changing anything, establish four numbers. Most teams can produce them in a week, and they tend to reframe the conversation faster than any argument does.
Real inflow against real closure over the last 90 days, counting findings actually resolved rather than findings triaged.
The count of risk-accepted and won’t-fix entries, along with the date each was last re-examined. Any date predating your organization's adoption of AI coding tools marks an entry priced under odds that have since changed.
The share of merged code with a human author, which tells you how much of your inflow can still be explained by the person who produced it.
The merge rate on security fixes: of the fixes opened last quarter, how many shipped?
The fourth number is usually the one that surprises people, because it has been the real constraint for years, while attention stayed on detection. Fixes get generated and never merged, so a program that produces more findings without moving that rate simply produces a longer queue.
A backlog trends down when three things hold at once: prevention cuts inflow at the moment code is authored, clearing runs without requiring a human decision on every finding, and fix correctness can be trusted without someone reading every diff. Get those three in place, and your team can move the needle on risk, burning down more than what’s coming in. The register starts shrinking for the first time since you opened it.
The job changes at that point because the work stops being in the queue and becomes the program.
BOOK A LIVE DEMO
Secure AI adoption at scale
Evo helps organizations safely adopt and scale AI by providing visibility, governance, and security across AI-driven development and AI applications.