# Remediation Is Becoming a Software Delivery Capacity Problem

> In our latest thought leadership brief, Remediation Is Becoming a Software Delivery Capacity Problem, completed in partnership with Google Cloud, Futurum Research examines why the queue between a validated finding and an approved fix is now the capacity problem for security and engineering leaders…

- Canonical: https://trial.futurumgroup.com/research-reports/remediation-is-becoming-a-software-delivery-capacity-problem/
- Kind: Research Report
- Published: 2026-11-04T15:11:53.000Z
- Updated: 2026-11-04T15:11:53.000Z
- Authors: [Vikram Rathnam](https://trial.futurumgroup.com/vikram-rathnam/), [Mitch Ashley](https://trial.futurumgroup.com/mitch-ashley/), [Fernando Montenegro](https://trial.futurumgroup.com/fernando-montenegro/)
- Practice areas: [Cybersecurity](https://trial.futurumgroup.com/practice-areas/cybersecurity-resilience/), [CIO Insights](https://trial.futurumgroup.com/practice-areas/cio-technology-buyers/), [Software Lifecycle Engineering](https://trial.futurumgroup.com/practice-areas/software-lifecycle-engineering/)
- Tags: AI agents, AI code remediation, AI-generated code, Application Security, CodeMender, DevSecOps, Gemini, Google Cloud, Software Delivery, Vulnerability Remediation
- Access: The full report, its underlying data and the analyst time behind it are available to Futurum clients. The body served here is the report’s public summary and is free to read, quote and cite with attribution.

Finding software flaws is getting cheaper, but fixing them is not. At 40% of organizations, AI generated or substantially modified most of the code merged in the preceding 90 days, yet only 34% of development time goes to new software, and scan-and-triage cycles built for code written at human speed cannot keep up. The constraint has moved to the queue between a validated finding and an approved fix: pull requests waiting on review, findings waiting on an owner, and patches waiting on a test run. The risk is already reaching production. A total of 75% of organizations had a production incident in the past year in which AI-generated code, agent actions, or AI tooling contributed, yet only 43% mandate human review of AI-generated code, and only 12% evaluate agent output before promotion. Closing that gap means security and engineering leaders share the fix: security sets the approval threshold, and engineering applies it in the pipeline. In our latest thought leadership brief, Remediation Is Becoming a Software Delivery Capacity Problem , completed in partnership with Google Cloud, Futurum Research examines why the queue between a validated finding and an approved fix is now the capacity problem for security and engineering leaders, defines six requirements for any AI code remediation agent, and maps CodeMender, an AI code remediation agent available on Google Cloud, against those requirements. In this brief, you will learn: Why the bottleneck has moved from finding flaws to fixing them How to measure time to a validated fix, from a validated finding to an approved, regression-tested change Six requirements to set for any AI code remediation agent, and the questions to ask vendors How CodeMender maps to those requirements, plus four recommendations for security and engineering leaders If you are interested in learning more, be sure to download your copy of Remediation Is Becoming a Software Delivery Capacity Problem today.