Name: The Hidden Effort Curve of Remediation: 15,000 Fixes, 500 Projects, 9 Languages
Start: 2026-11-06T11:30:00-0800
End: 2026-11-06T12:15:00-0800

The Hidden Effort Curve of Remediation: 15,000 Fixes, 500 Projects, 9 Languages

Friday November 6, 2026 11:30am - 12:15pm PST

Room: Grand Ballroom B (Street Level)

Every week brings another headline about a new way to find vulnerabilities in open-source and other code. The much-talked-about “Vulnpocalypse” is coming. But the bottleneck was never finding vulnerabilities, it is fixing them. We wanted to know how much effort this will take.

Every security team triages its backlog the same way: sort by CVSS, fix the criticals first. That ranking quietly assumes severity tells you how much work a fix will be. We tested that assumption against data and found it not to be true!!

Using AI-assisted analysis, we measured the remediation effort for 1,127 fixed vulnerabilities across 20 open-source projects: Firefox, Django, PostgreSQL, Keycloak, Tomcat and others that span nine languages. For each one we pulled the actual fix commits, scored the change on a three-part difficulty rubric, and sorted it into Low, Medium, High, or Extra High effort.
This talk walks through the data, shows where severity-first triage misjudges the work, and gives you a class-based way to estimate effort you can try on your own findings immediately. By November the dataset will cover 500+ projects and 15,000+ remediations. Given the timing, we will include data on vulnerabilities surfaced by Mythos-class models and techniques and whether that newer class of findings is harder or easier to remediate.

This is a data-heavy talk. If you are a data geek, you’ll enjoy it.

Speakers

Michael Cartsonis

Co-Founder, AppSecAI

Michael Cartsonis is a co-founder of AppSecAI . OWASP OASIS project and co-author of Two Cycles, One Codebase: A New Operating Model for Application Security.

At AppSecAI, Michael leads product strategy for the industry's first AI-powered Fix Automation system that generates valid... Read More →

Bruce Fram

CEO, AppSecAI

Bruce Fram is the CEO of AppSecAI, his and was a six-time venture-backed CEO before including being the CEO of Contrast Security. He started as a hands-on coder, spent two decades running companies instead of writing code, and credits GenAI with handing the ability to answer complex... Read More →

Friday November 6, 2026 11:30am - 12:15pm PST
Room: Grand Ballroom B (Street Level)

Implementation

Audience All

OWASP Global AppSec USA 2026

Michael Cartsonis

Bruce Fram

Get help with the event

OWASP Global AppSec USA 2026

Michael Cartsonis

Bruce Fram

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event