SAN FRANCISCO — The cybersecurity industry runs on a bubble of hot air, scaring enterprises into spending tens of millions of dollars on products and services that often yield no verifiable results, a longtime industry veteran and entrepreneur told the 2026 OWASP Global AppSec USA conference here today.
But, warned Jeremiah Grossman, co-founder and CEO of Root Evidence, a reckoning — Grossman calls it a "market correction" — is coming.
Cyber-insurance carriers have reached the point where there's enough data on vulnerabilities, exploits and breaches to be able to tell which products, tools, methods and protocols work — and which don't.
Grossman said his company's own findings hint that most cybersecurity efforts have no positive impact on an organization's bottom line. If the insurance actuarial data yields similar results, as he thinks it will, the impact could reshape the entire industry.
Some cybersecurity providers will try to continue selling products on faith alone, he predicted. Others will measure outcomes — and assume part of their clients' monetary costs when they get it wrong.
"Our industry works on compliance and FUD," or fear, uncertainty and doubt as vendors scare enterprise into buying their product to avoid doom, Grossman told the OWASP keynote audience. "You don't buy a coffee maker on faith. Why do we buy security that way?"
Much smoke, little fire
For the past 30 years, Grossman said, cybersecurity teams have followed the same procedures: Find as many vulnerabilities as you can, assign each one a score, prioritize their remediation according to those scores — and pray you don't get hacked.
"We've just been guessing," he said.
But now, there's enough empirical evidence to see how accurate those guesses are. His company statistically analyzed how many listed common vulnerabilities and exposures (CVEs), or known software vulnerabilities, are actually dangerous.
Setting aside CVEs in WordPress plugins and other WordPress-related software, Grossman said 250,143 CVEs were aggregated from 1999, when the CVE listing program began, until mid-2025.
Of those 250,143, he said, only 3,769 CVEs, or 1.5%, had ever been exploited. Of those that were exploited, 3,058 had patches available when they were disclosed. Only 711, or about 0.3%, were true zero-days, vulnerabilities exploited before public disclosure.
Those figures fit with what Grossman said his insurance industry contacts informally told him: In total, only about 600 CVEs really matter.
This has been apparent for years if you bothered to look, Grossman said.
When he ran WhiteHat Security 20 years ago, he noticed that even though half of web-facing vulnerabilities never got patched, almost nothing happened as a result. There were no campaigns, no breaches, no losses tied back to most of those vulnerabilities.
Ten years later, as Sony was facing an onslaught of hacktivist attacks related to its policy on PlayStation jailbreaking, Sony asked WhiteHat to fix every vulnerability on all Sony-owned websites worldwide.
His team spent six weeks patching the websites, watched as hacktivists planned attacks in chatrooms, and still nothing happened — even though Sony's sites still had a ton of vulnerabilities.
Attackers would try, they would encounter resistance, and most of the time they'd just give up and move on to easier targets, Grossman said.
"You don't have to be perfect to fend off the bad guys," he explained. "You just have to be a little more secure than eBay."
So which vulnerabilities do matter?
One-third of the exploited vulnerabilities in Grossman's survey set fell into familiar categories: OS command injection, path traversal, SQL injection, cross-site scripting, unrestricted file upload, missing authorization, and so forth.
"The most exploited bugs aren't exotic," Grossman said. "They're on every OWASP cheat sheet."
Regardless of category, many affect the same handful of vendors: Microsoft, Apache, Cisco, Apple, and Google.
"Adversaries keep returning to what works," he observed.
But then what about the feared "vulnpocalypse" that's everyone's been dreading as bug-finding frontier AI models scour software for hidden zero-days?
Grossman has seen no statistical evidence of that happening. Defender windows, the period of time between initial disclosure and initial exploit, are not shrinking. In fact, the median defender window is getting larger.
Likewise, the proportion of zero-days among CVEs is not climbing. The only thing that's increasing is the number of new CVEs.
"AI is changing volume, not velocity," he said.
Not only do most CVEs lead to no financial loss, the severity scoring system can itself skew results. A high-severity vulnerability may end up causing less loss than a medium-severity one that goes unpatched because it falls lower on the priority list than the budget allows for.
"Every [vulnerability] backlog has a cutoff line," Grossman said. "But nobody says where."
Meanwhile, the insurance companies don't categorize patches according to a vulnerability's score. They look at which vulnerabilities turn up in claims, and they're noticing that even some security mitigations — "certain edge tools and VPN devices," Grossman said — correlate with a higher rate of claims filed.
"People with money on the line sort by loss, not severity," he said. "How many of our security dollars are wasted every day chasing theoretical super-hacker risks that don't result in any breach ever?"
Insurance companies are not disclosing the evidence they have, Grossman said. Some of it is shielded by attorney-client privilege. He would rather it be public so that we can all learn from it, just as aircraft safety has improved because the FAA publishes post-accident reports.
But he thinks we'll soon see insurance carriers subrogating, or trying to collect money from, third-party vendors whose products were initial attack vectors into their clients' systems.
We're already seeing insurance companies demand steadily higher standards of security as time goes on.
"Not knowing what you expose stops being an excuse and starts looking like negligence," Grossman said in one of his presentation slides.
Two paths you can go by
Cybersecurity companies are facing a juncture, Grossman said. They can double down on bug-finding AI models to achieve "vulnerability zero," a term Grossman said he heard at this year's Black Hat conference. But that would take a huge number of tokens and a huge amount of money.
Or, he said, they can focus on the vulnerabilities that attackers actually use and fix those first. And they can offer guarantees.
"At my company," Grossman said, "I tell customers I'll cover the first $5 million in losses if they get breached."
That sounds like a big risk on a cybersecurity vendor's part, but Grossman said that finding about one bug makes certain that it's quickly patched for all his other customers.
The impact of actuarial, empirical data to replace blind faith will be better for the cybersecurity industry in the long run, he added.
"Hope is not a strategy," Grossman said.
