40,000 CVEs and counting: What 60 years of AppSec tells us

Application security is not improving at the rate the industry's investment would predict. CVE counts keep climbing. Breach costs keep rising. Tooling proliferates. And the same vulnerability classes — injection, authentication failures, insecure deserialization — keep appearing in post-incident reports, year after year.

Something structural is being misdiagnosed.

This talk distils 60 years of application security history and connects it to the engineering reality organisations are navigating today. It is based on research and practitioner observation across large-scale deployments, and draws on a keynote delivered at OWASP AppSec Singapore 2025. The goal is practical clarity about which problems are structural, which are self-inflicted, and which approaches are finally worth the investment.

This session is appropriate for CISOs, security architects, AppSec leads, and senior engineers making decisions about where to direct security investment. It provides a coherent historical framework for understanding why the industry keeps repeating itself, and a practical lens for distinguishing approaches that address root causes from those that address symptoms.