AppSec Overflow 2026: the numbers behind a broken model

For twenty years, application security has run on the recipe: Find the vulnerabilities, decide which ones matter, and fix them before someone exploits them. It has mostly worked up until now, but it doesn’t anymore, and AI is the reason.