Cross-tool disagreement wasn't even the harder problem in that test. The internal number was worse: one scanner run three times against identical code reproduced only 17 percent of its own findings [7], meaning the same tool on the same commit came back with a different queue each time. A list a team cannot reproduce is a list it cannot burn down or audit.
The economics point the same way. Contrast puts the API cost of scanning a 2-million-line codebase at roughly $315 [8] and the cost of triaging what came back at about $128,000 [9]. That is a ratio of about 406 to 1 [1]. Generation costs about what compute costs; adjudication costs about what people cost.
Which is why the exploit telemetry carries more weight than the finding counts. Forty-two confirmed viable attempts a month against 3.4 closures works out to roughly twelve triggered exploit attempts for every vulnerability a team retires [4]. Untrusted deserialization led those confirmed exploits, followed by path traversal and method tampering [4], and SQL injection sat in the top five techniques across every vertical Contrast tracked [5]. Log4Shell and Spring4Shell are both still visible in production telemetry [13]. At the observed closure rate, an average 106-finding backlog is about 31 months of work, and the high and critical findings alone are about six and a half months if nothing else gets touched [2][3]. The average highest-severity fix takes 92 days [12].
The attack-volume figure needs reading carefully. One adversary touch every four minutes [2] is roughly 10,800 events per application per month [5], but Contrast also reports that more than 60 percent of applications see fewer than 3,000 attacks a month while more than a quarter absorb 30,000 or more [20]. The mean describes the top quartile, not the median application.
Scores narrow the field without settling it. Contrast found 82 percent of the CISA KEV entries in its dataset carried an EPSS score of 90 percent or higher [18], which is a usable filter. Two entries, CVE-2006-1547 and CVE-2023-38180, each carried CVSS 7.5 with EPSS under 25 percent, and both were confirmed exploited in the wild [19].
The supply side is moving in the same direction. Zero Day Clock, drawing on more than 83,000 CVEs, put mean time to exploit above two years in 2018, below one year by 2021, and found the majority of vulnerabilities exploited in 2025 were weaponized within three weeks [16]. Thirteen weeks to fix the worst class against three weeks to weaponize is a gap of about four to one [6]. HackerOne paused new submissions to the Internet Bug Bounty in March 2026, and Node.js paused its own program shortly after, citing the loss of that funding [17].
One caveat, stated plainly: this is vendor telemetry. Contrast CISO David Lindner's framing is that these tools disagree with each other, disagree with themselves between runs, and cannot describe how an application behaves while someone is attacking it [14], and that argument favours the in-production vantage point Contrast measures from [1]. The 17 percent reproducibility figure is the part any team can check on its own code, at the price of one rerun.
