News
featured articles
%20(1).png)
Code Volume Diverged From Headcount. Pricing Must Follow
For most of AppSec's history, developer headcount was the only reliable number available, so it became the number the market priced against. More developers meant more code. More code meant more risk. Seat-based pricing and seat-based TAM models followed, and both held up for over a decade.
They don't anymore. And the TAM is considerably larger than the seat-based spreadsheets suggest.
The market was built on a correlation, not a cause
The old math was clean. As of 2021 there were roughly 28 million developers worldwide, about 60% of them at companies with more than 50 employees. Blend a per-seat price across the usual module set, SAST, SCA, secrets scanning, IaC, ASPM, and you land somewhere around $500 per developer per year. Multiply it out and the AppSec TAM comes to roughly $8.4 billion, projected to climb to around $14 billion by 2030 on the back of 3 to 5% annual headcount growth.
Not bad.
The model made sense because the correlation held. One developer produced roughly one developer's worth of code, so headcount was a fair stand-in for output. The seat was a unit that meant something. Every AppSec pricing page, and most of the TAM decks behind them, still run on that assumption, projecting the market forward by projecting hiring forward.
Five years later, professional developer headcount still grows in the low single digits. Code output left that curve. GitHub processed 986 million commits in 2025, a 25% jump in a single year after a decade of low-teens growth. Platform totals blend many things together, including a record year of new signups, so treat that number as directional.
The per-developer data is where the break shows up. Cursor's usage data shows mean lines added per developer per week climbing from 3.6K to 8.6K in about seventeen months. Lines added per pull request at the 75th percentile are up roughly 2.5x year over year. The growth rate is still accelerating.
Per seat pricing models stopped meaning anything.
Beyond volume, the seat itself stopped functioning as a stable unit. A marketing manager with the right tooling can ship more code in an afternoon than some backend engineers ship in a week. A team of ten, properly equipped, outproduces a team of hundreds running outdated practices. None of it shows up in a headcount projection, because headcount was never measuring output. It was measuring who had a badge and a laptop.
When a badge reliably produced a predictable amount of code, per-seat licensing made sense. Now a single seat can produce zero lines in a week or a thousand in an hour, generated by a swarm of agents running continuously against a codebase. A unit that can represent either reality at any given moment isn't a unit worth pricing against.
Once headcount stops tracking output, pricing products or sizing the market on it stops making sense. Code defines the attack surface, not the developer who happened to be logged in when it was written. Pricing and sizing product security against code produced is a straightforward correction.
The formula changed in five years:
2021: [seats] x [security modules]
2026: [code volume] x [risk]
Run the napkin math and the $14 billion 2030 projection looks conservative. A market growing in the low single digits and a market compounding past 25% a year part company fast. Within a few years they are no longer versions of the same forecast. They are different markets.
Not all code deserves the same scrutiny
The argument comes with an obvious caveat. Raw line counts aren't the whole answer, because all lines aren't created equal. A payment service and an internal dashboard do not deserve the same scan frequency, the same review depth, or the same scrutiny, even if they produce a comparable number of commits in a given week.
The real unit is risk-weighted code: what a change touches, who and what can reach it, how exploitable it is once it ships. Weight the volume by risk and the growth story holds. Risk-weighted volume grows slower than raw lines, since agents generate plenty of scaffolding and tests, but it still compounds an order of magnitude faster than headcount. The caveat narrows the number. It doesn't rescue the seat.
Risk weighting is also why validation matters more than finding count. A scanner that produces more alerts as code volume grows is describing the problem faster, at higher cost. Sizing and pricing against code volume holds up only if the code being counted is weighted by what it can do to the business.
Are we moving to consumption based AppSec?
I can't speak for the market. I can speak for Prime: we priced the product on consumption, because seats no longer count anything. Security context has to follow code and risk, from architecture through code to the running environment. A model priced on seats can't scale with a codebase that no longer scales with people.
If you're a buyer, run the test yourself. Chart your code volume against your headcount for the last eighteen months, then put that chart next to your security invoices. If the invoices track the flat line, you know which market your vendor is pricing. And stop negotiating what counts as an active developer. That fight exists because the unit is fake.
Consumption will cost some buyers more, and that's worth saying out loud. But the spend isn't new. The attack surface grew the moment the code shipped; a seat-based invoice just didn't register it. Risk-weighting keeps the meter honest: scaffolding shouldn't cost what a payment service costs. You pay for the risk you're carrying, which is the only number worth paying against.
Ready to see what it looks like to size and secure your codebase by what it actually produces, not by how many seats are logged in? Learn more at primesec.ai.
Cutting Through ProdSec Noise
Prioritizing Vulnerabilities by Context Driven Attack Paths, Not Severity Score
Open any vulnerability dashboard right now and you'll see the same thing every security team sees: more findings than anyone could review in a lifetime, ranked by severity scores that all cluster near the top. Roughly 48,000 new CVEs were published in 2025 alone, and the average program has bandwidth to remediate somewhere between 10 and 15 percent of its backlog in a given month. That gap between what gets found and what gets fixed isn't a staffing problem. It's noise, and it's been mistaken for a risk picture for long enough that most teams have stopped questioning it.
Vendors have started layering exploitability and reachability signals on top of severity scores, flagging whether a CVE has a known exploit in the wild or whether the vulnerable function is actually called by application code. That's a real step past CVSS alone, and it does cut some findings out of the queue. But exploitability and reachability answer "can this be exploited," not "does it matter here." A reachable, exploitable vulnerability in an internal tool with no sensitive data behind it is a different risk than the identical vulnerability in a service with a direct path to payment data, and exploitability scoring alone can't tell those two apart. Without the business and architectural context to make that distinction, exploitability and reachability data just re-sorts the same pile into a slightly different order. It doesn't reduce it.
Where All This Noise Comes From
Noise doesn't come from one bad scanner. It comes from the fact that every scanner you add reports its own findings in isolation, with no view of whether anything it flags actually connects to anything else. SAST grades code. SCA grades dependencies. Secret scanning grades commits. Each one is doing its job correctly, and each one is contributing its own independent stream of severity-ranked findings to a backlog that was already too large before it showed up.
That fragmentation was survivable when code shipped at human pace. AI coding agents have removed that constraint, and the backlog is growing with it. A developer opens a handful of pull requests a day; an agent working in the background can open dozens, and every one of them triggers its own pass from every scanner in the pipeline. The noise problem stopped being something a team could plan around once a quarter and became something that compounds with every commit an agent makes, which means the case for reducing it is no longer theoretical. It's urgent, and it gets more urgent by the day.
Adding tools to cover more of the stack feels like progress, and in a narrow sense it is. But it also means the noise compounds. Four scanners each reporting cleanly on their own slice of the product doesn't add up to a quieter picture of risk. It adds up to four separate streams of findings, none of which know about the other three, and that isolation is exactly what produces false positives and false confidence in the same breath. A scanner with no view of the environment has no way to know a downstream control already neutralizes what it just flagged, so it reports a real finding as urgent when it isn't. The opposite failure is just as common: without understanding how the surrounding system actually behaves, a tool can't verify whether a vulnerability it found is reachable in an actual attack path, which means genuine risk gets buried in the same pile as the noise around it.
Why More Noise Doesn't Mean More Security
The instinct is to sort the noise by severity and work top-down. That fails because severity measures how bad a vulnerability could theoretically be, not whether it's reachable, exposed, or exploitable in this specific environment. Two findings with identical CVSS scores can carry completely different risk depending on what's around them: one sits behind three layers of controls, the other has a direct path to production. A backlog sorted by severity alone treats those as the same problem, which is exactly why teams burn remediation capacity on findings that were never going anywhere while genuinely dangerous ones sit untouched further down the list.
Cutting Through the Noise Starts with One Question
Cutting through that noise isn't a matter of triaging faster or tuning the scoring model harder. It requires asking a different question of every finding, one severity scores were never built to answer: is this part of a path an attacker could actually walk right now, given what it connects to. And more importantly, how feasible is this path? If an exploit requires Tom Cruise to dangle dramatically from the ceiling, it’s unlikely to be prioritized by attackers. In other words, there is no simple solution that relies on a single score…which is exactly why context matters!
That's an execution-path question, not a severity question, and it changes what "important" means. A CVSS 9.8 sitting on a service with no route to anything sensitive isn't urgent, whatever the score says. A medium-severity finding sitting on a component that connects straight to a trust boundary might be the most important thing in the backlog. Severity describes a finding in isolation. An execution path describes what happens once you stop looking at scores and start focusing on the real impact to the business and how exposed the vertical to that impact.
What's Left When You Filter for Execution Paths
Run that filter honestly and the backlog doesn't just get shorter, it changes shape entirely. What's left isn't a smaller version of the same list sorted the same way. It's a small, specific set of findings that are reachable and chained together into something an attacker could actually use, the kind of path where a component that passes its own scan cleanly still turns out to be one link in a route to something that matters.
Building a Practice Around Signal, Not Volume
None of this is an argument for buying another scanner. Another scanner adds another stream of severity-ranked findings, which is exactly the problem, not the fix. What's needed is something that doesn't produce its own isolated list at all: a way of seeing the product as one connected system, where a finding is judged by what it opens up rather than scored and filed on its own.
SAST, SCA, and secret scanning were built to grade their own slice of the product well, not to reason across slices, and no amount of tuning changes that. What's missing is a layer above all of them, one that holds architecture, data flows, and access paths in view together and asks the question none of the individual scanners can: does this finding sit on a path an attacker could really walk, given everything else true about this product right now.
The Elephant in the Room: Developer Alert Fatigue
The noise problem doesn't stay in security's backlog. Every finding that reaches a developer without context asks them to stop and chase down whether it's real, and often it isn't: a downstream control already handles it, the path doesn't exist, the function isn't even called. After enough of those empty chases, the rational response isn't more diligence. It's discounting the next finding, and the one after that.
That erosion is the real cost. It isn't just inefficient for security teams triaging a backlog. It teaches developers, correctly, that most of what lands in their queue isn't worth their time, which means the findings that actually matter now have to fight through that learned skepticism to get acted on at all. The fix isn't more findings or sterner tickets. It's surfacing only what's already been checked against the path it would need to travel.
What This Means for Security Leaders
The measure of a good vulnerability management practice was never how many findings you closed this quarter. It's whether what's left in front of your team, after the noise is filtered out, is actually worth their time. A shorter list sorted by the same broken signal isn't progress. A list built from real execution paths, however short, is.
At Prime, this is the case for correlating findings against real execution paths across the whole product rather than triaging them one severity score at a time, so what reaches your team is what an attacker could actually walk, not everything a scanner happened to flag.
Ready to see what's left once the noise is filtered out? Learn more at primesec.ai.
Software Security Needs a New Unit to Review
For the last decade, the pull request has been the moment a developer's work paused long enough for someone else to look at it. That pause is what turned the PR into a checkpoint. A reviewer read the diff and checked it for whatever could go wrong: bugs, broken business logic, security holes. Nobody designed the PR to be a security control. It became one because it was the last place in the software lifecycle where a person reliably paid attention before code shipped.
Now agentic development is breaking the math that made the diff work. PRs are getting bigger and more frequent at the same time, and the pause they run through hasn't gotten any longer. The unit of review is shifting under security's feet.
Before anyone scanned PRs, security tools ran against whole repositories, and compliance programs accepted that as review. The results were unusable: thousands of noisy findings and no way to tell which ones mattered. So the industry moved down to the diff. It was the easiest unit to work with, not the right one.
The PR is changing. Drastically.
Look at what a pull request is actually made of: a diff, a comment thread, and an approval button. None of it was ever the control. It was just tooling built for the moment someone paused to review the work. The pause survived on three conditions. PRs stayed small enough to read closely. Rare enough that every one of them got read. And the review produced a handful of issues that a developer will actually fix.
Agentic development is killing all three at once. Cursor's enterprise data shows average PR size more than doubling, with volume up another 25% on top. Mega PRs, 1,000 lines or more, are now routine. A Microsoft study of Claude Code and GitHub Copilot CLI users found adopters merging roughly 24% more PRs, hitting 50% in heavy-use weeks and holding there for four months. And bigger PRs carry more issues per review, pushing every comment thread past the point where developers stop reading it.
Any one of these would strain a review built around a careful pause. Together they take away everything it needed: time per PR, few enough PRs to give each one that time, and findings scarce enough to get fixed.
What's actually inside all those new PRs
Volume is only half the problem. The other half is what's landing inside each PR. CodeRabbit's analysis of AI-co-authored pull requests found they carry roughly 1.7 times more issues than human-only PRs, including 1.5 to 2 times more security-relevant findings like improper credential handling and insecure object references. High-issue outliers cluster in AI-assisted work. So a reviewer doesn't know which PR needed the slow read until they've already skimmed past it.
Compliance programs accept PR approvals as evidence that changes were reviewed before deployment. Today, the audit trail looks exactly like it did three years ago. What's changed is what that approval means. It used to mean someone read the code. Now, on a 1,500-line agent-written PR that arrived with six others that morning, it mostly means the person ran out of reasons to keep it open. The requirement is still being met on paper. Whether real security is happening underneath is a separate question, and no audit is built to ask it.
The unit was always a proxy
Once you see the PR as a stand-in for attention rather than a control in its own right, the question changes. Scaling review to handle more, bigger PRs is the wrong project. The real question is where that attention needs to live now that it can't all sit in one checkpoint.
Some of it belongs below the PR, where an agent makes decisions in real time and context can be applied before a diff exists. Some belongs above it, at the repository level, because a vulnerability spread across several small, reasonable PRs never shows up in any single diff. And some belongs before the PR entirely, in the architecture and design decisions that shape what an agent, or a developer, can build in the first place.
The repository level is the one that should give people pause, because the industry has been there before. Repo-wide analysis is where this story started, and it collapsed under its own findings. But that was a context problem, not a level problem. The tools flagged patterns without knowing what was reachable, what was exploitable, or what mattered to the product. Analysis that traces attack vectors and validates exploitability before it surfaces anything produces the one thing the old scanners never could: a short list. Five findings a developer will actually fix, with a risk score that is attached to a product. The comment-count condition, restored at the level the industry abandoned.
So PR reviews are dead? Right? Right?
No, PR reviews aren't dead. The pause they measured is.
Reviews stay in the program as one place security happens, not the primary one. Attention has to live where decisions live now: in the design before code exists, in the code as it's written, in the repository as it evolves. This is what we do at Prime, that's the architecture: review the design, guard the code, trace attack vectors across the repo, dependencies, and cloud continuously.
Prime introduces a new operating model for Product Security
Prime Security today introduced a new operating model for Product Security, expanding its platform to help security teams participate in every product decision - from architecture and design through implementation and continuous validation.
The announcement comes as the company returns to Black Hat USA, one year after winning the conference's prestigious Startup Spotlight competition, where it will showcase the expanded platform this week in Las Vegas.
Prime's expanded platform addresses a fundamental change in how software is built. As AI accelerates engineering and compresses the distance between architecture, implementation, and deployment, security can no longer rely on reviewing finished code alone. It must participate continuously as products are designed, built, and shipped.
From day one, Prime has taken a different approach to Product Security. Rather than analyzing isolated pieces of software, the platform was built to understand products as complete systems - starting with architecture and design decisions, where critical security context is created long before code is written.
That architectural foundation now extends across the entire product lifecycle, enabling security teams to participate before the code, in the code, and after the code through a shared understanding of the product.
The expanded platform includes autonomous design reviews, AI security code reviews, AI coding guardrails, risk-focused software supply chain security, and continuous white-box pentesting - all powered by the same understanding of the product and its architecture.
Prime CEO Michael Nov said:
"Software development has fundamentally changed. Architecture, implementation, and deployment no longer happen as separate phases - they increasingly happen together, often inside the same AI-assisted workflow. Security can't keep up by reviewing software after it's built because the important decisions have already been made. Product Security has to participate as those decisions are being made. That's what Prime was built for."
Backed by Foundation Capital, Flybridge and Scale Venture Partners, Prime is trusted by organizations including PayPal, Bumble, Qualtrics, MX, and ThoughtSpot among its customers.
Customers report completing security design reviews in as little as 15 minutes, increasing security team capacity by 4-5x, and reducing false positives by up to 90% compared to traditional application security approaches.
Learn more at https://www.primesec.ai or visit https://www.primesec.ai/blackhat-2026 for Black Hat activities and event information.
Prime Security Raises $20M Series A December 2025
Prime’s new platform accelerates development with automated security reviews and full visibility into design-level risks
NEW YORK CITY and TEL AVIV – December 9, 2025 – Prime Security, creator of the first Agentic Security Architect, today announced its $20M Series A funding. The round was led by Scale Venture Partners, with participation from Foundation Capital, Flybridge Ventures, and Ofir Ehrlich, CEO & Founder of Eon. The new funding will fuel Prime’s go-to-market expansion and accelerate development of its Agentic Product Security Platform, a growing suite of autonomous AI agents that continuously monitor, assess, and guide product security throughout the entire development lifecycle.
Modern development runs at machine speed, but security still operates like an assembly line, slow, manual, and dependent on scarce expertise. Today, security teams have the capacity to manually review only a small fraction of planned work before release, leaving the rest to chance. As AI-assisted coding accelerates development velocity, this gap keeps widening. Prime’s agentic platform automates this manual craftsmanship, transforming design-stage protection into a continuous, intelligent process that scales with engineering.
"Integrating security into the design phase has always been a technically challenging manual process. Prime's unique approach transforms this critical, time-consuming stage." said Ariel Tseitlin, Partner at Scale Venture Partners. "This team are both visionaries and operators. Having led technical, GTM, and security teams at companies like PayPal and Own, and scaled enterprise Product Security programs, they've experienced firsthand the problem they're solving. This combination of category-creation vision and deep operational expertise is what defines market leaders."
Prime Security is developing a new era of Product Security, where AI agents bring security into the design stage of every software project and feature. Its flagship product, the Agentic Security Architect, autonomously conducts security design reviews and proactively identifies design flaws across development work. By embedding directly into engineering workflows, Prime enables organizations to accelerate reviews, cut manual effort and cost by more than 60%, and achieve nearly full coverage across planned development tasks.
“Modern product development is changing in front of our eyes,” said Michael Nov, Co-Founder and CEO of Prime Security. “We founded Prime to redefine how security fits into this new world, with agentic systems that operate starting at the design phase, not after development. Our mission is to build security that scales with engineering instead of slowing it down.”
After starting to commercialize the product earlier this year, Prime won the Black Hat 2025 Startup Spotlight this summer and is already working with dozens of customers including PayPal, Qualtrics, Bumble, ThoughtSpot, Redis Labs, and others with development teams of over 200 engineers who are seeing significant impact including:
- Up to 30x faster resolution of design-stage risks
- 100% of planned work receives security assessment versus 10-15% with manual reviews
- 50% reduction in time and cost spent on security reviews
“At PayPal, we know that security must evolve as fast as the threat landscape,” said Shaun Khalfan, CISO at PayPal. “Prime Security’s autonomous, design-stage reviews give us continuous and adaptive visibility across our engineering ecosystem, enabling us to identify and address risks earlier in the software development lifecycle. This capability helps us move with speed and confidence to deliver for our customers and strengthen trust in our business globally.”
By providing continuous, automated security assessment of all planned work, Prime empowers security teams to focus on strategic architecture while ensuring comprehensive coverage of every feature, enhancement, and change flowing through the development pipeline.
ABOUT PRIME SECURITY
Prime Security provides an agentic-powered platform that enables security teams to detect, prioritize, and mitigate risks at the software design phase. Founded in 2023 and headquartered in New York with offices in Tel Aviv, Prime integrates with leading engineering tools to deliver 100% coverage of development efforts without slowing engineering down. The company is SOC2 Type II certified and backed by Scale Venture Partners, Foundation Capital, Flybridge Capital Partners and PayPal Ventures. For more information, visit the website.
Media Contact:
Morgan Grandi
morgan@primesec.ai
Prime Security Is Now GA
Today, we’re announcing that Prime Security is officially Generally Available, the first AI Security Architect built to bring security into the design stage of every software project, without slowing development. Development velocity has gone through the roof (thanks, AI), but design-stage security reviews stayed manual, slow, and dependent on a handful of experts. Prime closes that gap.
Prime automates the entire design-review process: discovering design-stage risks across all planned development work, interpreting tasks and documents with full business context, and generating complete security reviews, risks, mitigations, data flows, and compliance ties, in minutes. It operates directly inside engineering workflows, giving teams near-total coverage without forms, questionnaires, or chasing down developers.
With GA, Prime is enterprise-ready: automated reviews for Jira, Confluence, PRDs, and AI-generated plans; risk identification and prioritization; mitigation recommendations aligned to frameworks like NIST, CIS, PCI, and HITRUST; and a self-serve Security Architect chat experience for engineers. Teams at Qualtrics, Yext, ThoughtSpot, and others are already using Prime to accelerate secure development at scale.
Security can’t rely on manual architecture work in an AI-accelerated world. GA is the next step toward Agentic Product Security, where autonomous AI agents continuously monitor, assess, and guide design-stage security. Prime is now ready for every team that needs to secure modern development without slowing it down.
Security Design Reviews vs. Threat Modeling (April 2026)
The Nuances of Design Stage Security
If you work in cybersecurity (or security adjacent) you are very familiar with the 2 main practices that help to identify and remediate security concerns before development starts; Threat modeling and Security Design Reviews. Both are practical capabilities, and while threat modeling has a variety of frameworks, design reviews are more of a delicate and tactical process that heavily relies on an intimate knowledge of the business. But have you ever felt like your security reviews are missing the mark? Maybe they’re too generic or don’t account for the unique risks your business faces. The challenge often lies in capturing that elusive business context. While threat modeling is a powerful tool, it often happens to be a hammer, and so reluctantly security has to see every design problem as a nail. This makes threat modeling a default approach even when a more nuanced method, like targeted security reviews, would be more effective. By harnessing Large Language Models (LLMs) to sift through unstructured data, we can finally bring the vital context needed to scale security reviews across the board and provide a supercharged version of this method to security practitioners.
Context: The Critical Factor
Traditional security checks often fall short because they can’t adapt to the specific nuances of your business, and threat modeling alone can’t address all the intricacies of secure development. This is where LLMs come into play. By leveraging new LLM empowered capabilities early in the design stage of the SDLC, we can enhance security reviews with deeper context and precision, making them more effective and efficient. This approach allows you to weave security into your systems right from the start, rather than relying on exhaustive modeling for every scenario.
Providing developers with business-driven, concrete security requirements upfront reduces friction and ensures the right tools are used at the right time. By leveraging security reviews at scale for ongoing, contextual feedback, development teams know exactly what’s expected before writing a single line of code, minimizing rework and keeping projects on track. It substantially reduces the dependency on sometimes very cumbersome threat modeling processes that can be an overkill for the task at hand.
Prime Security: Embedding Security before Development starts
At Prime, we focus on security design reviews because we know they’re the most practical and proactive way to secure products from the ground up. By providing the infrastructure to capture and integrate business context, Prime ensures that your security reviews are tailored to the specific needs of your organization. The result? A product that’s secure by design, allowing your teams to move fast without sacrificing security.
Building Prime Security
As security professionals and technical leaders we’ve experienced the main pain in developing products. The constant struggle of balancing development velocity with security needs. Through it all, one thing became clear, many security challenges could be prevented given the right context at the design phase of the SDLC. Too often, security comes in at the last minute, scrambling to apply fixes after development is complete, leaving both teams frustrated and out of sync.
Sure, security exists in the SDLC today, but it starts to scale when code is written. You can scan for dependencies, catch bugs, and identify vulnerabilities. But Product Security shouldn’t start with code scanning; it needs to start with design. It’s not just about applying processes or enforcing policies; it’s about influencing decisions before a single line of code is written. Security teams need actionable insight into what’s being built and why, from the earliest stages. But extracting that insight is challenging, scaling it across fast-paced teams is even harder, and making it stick while everyone’s sprinting to meet deadlines can feel nearly impossible.
That’s why we built Prime Security. To truly integrate security into modern development, it has to start at the design phase, not after. We’re not here to slow development down; we’re here to give security engineering teams superpowers so they can support developers to make smarter decisions, faster - embedding security directly into their workflows.
With our unique business and security context extraction engine, Prime Security automates risk assessments and generates tailored mitigation recommendations, ensuring that security isn’t just an afterthought, but a partner in the development process. Prime brings hard-won insights from security professionals right to the point where they’re needed most. This isn’t about adding friction; it’s about unlocking development velocity without compromising on security.
This is the future of Product Security: practical, scalable, and context-driven decisions, integrated from day one. With Prime, security and development teams can truly build securely from the start, setting a new standard for scalable, design-first security. We’ve lived through these challenges, and we’re here to solve them, for good.
Michael, Dimitry, Danny, Matan
