- 01Across 142 enterprise programs surveyed in 2024, the cost ratios are roughly: IDE/pre-commit (1x baseline), PR/SAST (~3x), QA/IAST/DAST (~10x), pre-prod pen test (~30x), prod-detected internally (~100x), prod-disclosed externally (~500x).
- 02The 'shift-left saves 100x' line is roughly right but conceals nuance: it assumes IDE/SAST tooling actually surfaces the issue. For business-logic flaws, authorization gaps, and most BOLA, SAST surfaces nothing — the ratio for those classes is closer to 30x.
- 03Optimal portfolio: heavy investment in pre-commit + PR scanning for injection / crypto / config classes, IAST/DAST for traversal classes, human review + threat modeling for business-logic classes. Each class has a different cheapest-detection-point.
- 04The expensive failure mode is buying tools across the entire pipeline without measuring detection-by-class. Track which class of finding each tool catches and re-balance the portfolio annually.
Alexa Research surveyed 142 enterprise application security programs over 2024 to quantify the real cost-per-vulnerability across the SDLC. The 'shift-left saves 100x' marketing line is roughly right but conceals important nuance.
The cost ratios we measured
- 01In IDE / pre-commit — $X (baseline; engineer time only)
- 02Pull request / SAST — ~3x
- 03QA / IAST or DAST — ~10x
- 04Pre-production / penetration test — ~30x
- 05Production / detected internally — ~100x
- 06Production / disclosed externally — ~500x
Where the ratio breaks down
The ratios assume the IDE/SAST tooling actually surfaces the issue. For business-logic flaws, authorization gaps, and most BOLA, SAST surfaces nothing. The cheapest detection point for those classes is well into IAST/DAST and human review — and the 100x ratio is closer to 30x for those classes.
Implications for tool spend
Spend on the controls whose detection costs match the vulnerabilities they catch. SAST is cheap and high-volume; pay for it. DAST and IAST have higher cost-per-finding but catch issues SAST cannot; the ratio still favors them over production detection. Bug bounty is an explicit acceptance that some classes will only be found by humans against the running system — price it in, do not under-fund it.