New information finds 87% of monitored client-facing apps confronted assaults in 2026 — up from 55% in 2022 — as AI completely collapses the price and experience required to use them
iOS and Android assault charges have converged for the primary time — closing a 21-point hole and invalidating a decade of platform-based safety assumptions
RALEIGH, N.C., Might 19, 2026–(BUSINESS WIRE)–AI has created two simultaneous acceleration curves in enterprise software program: one for constructing it and one for attacking it. For many software program groups, publishing an app to the App Retailer or Google Play nonetheless seems like a product milestone. In 2026, it’s a safety publicity occasion.
Digital.ai’s 2026 Application Security Threat Report attracts on real-time risk monitoring information from purposes serving billions of customers throughout monetary providers, healthcare, automotive, and telecommunications. The report finds that as AI instruments speed up software growth and transport, attackers are utilizing the identical capabilities to maneuver quicker, inflicting the window between app retailer publication and first hostile contact to vanish.
One other key discovering cuts to the basis trigger: agentic AI has reset the economics of software program assaults. The talent, time, and value obstacles that when restricted subtle assaults have collapsed. Actions that when required specialised safety experience, customized tooling, and days of guide effort can now be completed by AI-assisted code inspection, exploit era, and malware adaptation in a fraction of the time.
The five-year assault price trajectory makes the correlation seen. The 55% → 57% → 65% → 82.7% → 87% climb — monitoring carefully alongside every main AI mannequin launch since 2022 — suggests the business has crossed a threshold. The query now just isn’t whether or not agentic AI-powered assaults will hold climbing; it’s whether or not enterprises will put money into defending in opposition to them on the identical tempo.
The Assault Floor Enterprises Left Uncovered
One enterprise buyer monitoring their software in manufacturing noticed hostile exercise lower than two hours after their app appeared within the retailer, a timeline per what Digital.ai’s broader risk telemetry exhibits. The window between app publication and first hostile contact is now measured in hours, not days.
Cellular purposes have turn into a main assault floor within the enterprise portfolio — and probably the most uncovered to the brand new attacker capabilities that AI has unlocked. The purposes that enterprises distribute immediately into the arms of billions of shoppers exist exterior the enterprise firewall. They stay on gadgets the safety workforce doesn’t management, in public marketplaces on the open web. When an attacker compromises a cell app, the app just isn’t the vacation spot; it’s the entry level. Reverse engineering a cell software offers an attacker a blueprint to the backend APIs, authentication logic, and server infrastructure that energy it — the identical infrastructure defending buyer information, transactions, and core enterprise operations.