Your dependencies are 278 days out of date and your pipelines aren’t protected

Multiple reports and incidents highlight growing security debt and supply-chain risk: Datadog finds dependencies are on average 278 days out of date and 87% of organizations run at least one exploitable vulnerability in production (affecting ~40% of services), while Veracode documents expanding app-security backlogs. Operational gaps (unpatched dependencies, unprotected pipelines) are increasing exposure. The news roundup also notes active threats and tooling changes — self-spreading npm malware, a Cisco SD‑WAN 0‑day exploited since 2023, rising focus on AI/agentic threats, and shifts in AI‑sI