Ordering is the easy part. The hard part is being ready when the report lands.
Ordering is the easy part
Signing a quote takes an afternoon. Actually fixing what the test finds takes longer. Veracode measures every year how long it takes to fix flaws in real code. The average has gone from 171 days in 2020 to 252 in 2025.[01]
252 dagar
average time to fix a flaw in code in 2025, up from 171 days in 2020. The report gets old before the list gets short.[01]
That is not an argument against ordering a test. It is an argument for ordering it in a way that keeps the list short from the start.
What an AI agent actually finds
An AI agent finds wider and faster than a person can alone. In DARPA's AI Cyber Challenge, the competing systems found 54 planted vulnerabilities and 18 genuine vulnerabilities in real open source code. Breadth is not the problem.[02]
An independent evaluation of several AI architectures in realistic testing scenarios found they get better at complex multi-step tasks, but also that they fail in recurring patterns. That is why breadth alone is not the proof.[03]
The problem is what breadth does to the queue. More findings that are not proven or ranked is not a better test, it is a longer list to sort through. So do not just ask whether a vendor uses AI to find more. Ask what happens to a finding before it reaches you.
What AI agents have found in real code
What makes a report actionable
Ask which methodology is used, and ask for a name. Frameworks such as OWASP's testing guide exist so findings can be compared between engagements and between years, not just described in free text.[04]
Then ask how findings are prioritised. A list sorted by severity is not the same thing as a list sorted by what is actually fixable first. A team with limited time needs the latter.
- Is a retest of the most serious findings included in the price?
- Are findings ranked by what is fixable, not only by severity?
- Is a name in the report, or just the company's?
- Who on your side owns the list after delivery, and do they have time set aside?
A hundred-line report is not an answer. It is a question about who does something with it.
Soon it is a date
Today, 11 September 2026, the EU Cyber Resilience Act begins requiring manufacturers of products with digital elements to report actively exploited vulnerabilities to the authorities. An early warning within a day, a final report no later than two weeks after a fix exists.[05]
The requirement is not about finding faster. It is about being able to answer faster. Whoever already knows what is open at home has an easier week than whoever finds out at the same time as an authority.