AI finds weak spots faster. Who keeps your product up to date?
AI is one reason open-source projects are getting far more security reports this year than in previous years. For anyone with their own software product, that means more updates someone has to apply.
No software product is written entirely in-house. Under your own code sit open-source components: a framework, a CMS, packages written by others. Every security report about one of those components may also affect your product.
What are the projects themselves seeing?
They are getting far more reports, mainly because AI makes scanning code much faster. At Node.js, the base of many JavaScript applications, the number of reports spiked in February 2026 after AI scanning tools arrived, the OpenJS Foundation reports. The WordPress security team sees the same and points to the rapid progress of AI. Spring, which many Java applications run on, used to get about 6.5 reports a month. Since March 2026 it has averaged nearly 80 external reports a month, on top of what Spring finds in its own code with AI.
Not every report is a real vulnerability. Each one has to be looked into first, and plenty turn out not to be a problem. What does turn out to be a real problem gets a fix.
Some projects are already adapting. From 22 October, Spring will ship all its regular fixes on one day a month instead of spreading them over two weeks, because some vulnerabilities are exploited within hours.
What does this mean for your product?
A fix only reaches your product once someone applies it. So someone has to keep track of which new security updates affect the components of your product and, where needed, update the component, test it and roll it out.
When your team is busy building new features, this work tends to slip. Your product then stays on the versions it went live with, and falls further and further behind. Jumping many versions at once is riskier than taking small steps regularly: a lot changes at the same time, and when something breaks, it is harder to see why. When an urgent fix comes out, you often have to catch up before you can apply it. And a version that is too old eventually stops getting fixes at all.
How do you know whether your maintenance is properly covered?
Ask yourself three questions:
- When were the components your product is built on last updated?
- Who on your team keeps track of which security updates affect your product?
- Is there a fixed slot in your schedule for this work?
If you have to think hard about any of these, the maintenance is probably not properly covered.
How to organise maintenance
Make it clear who is responsible for this and set aside fixed time for it. With your own team, you can schedule that time around the release days of the components you use, for instance. If a vendor built your product, check whether maintenance after handover is in the contract, security updates included.
No room for it in your own team? Backstage IT provides dedicated developers who maintain your product alongside building new features, security updates included. They use AI tools daily and review what those tools produce themselves. You can start with one developer and add more when the work calls for it. That developer works only on your product, and you direct the work.
Want to know where your product stands? Tell us briefly how maintenance works now, and we will go through it with you, with no obligation. Get in touch.
