OWASP Global AppSec: Cybersecurity industry overdue for a ‘market correction’

SAN FRANCISCO — The cybersecurity industry runs on a bubble of hot air, scaring enterprises into spending tens of millions of dollars on products and services that often yield no verifiable results, a longtime industry veteran and entrepreneur told the 2026 OWASP Global AppSec USA conference here today.

But, warned Jeremiah Grossman, co-founder and CEO of Root Evidence, a reckoning — Grossman calls it a "market correction" — is coming.

Only 711, or about 0.3%, were true zero-days, vulnerabilities exploited before public disclosure.

Those figures fit with what Grossman said his insurance industry contacts informally told him: In total, only about 600 CVEs really matter.

The impact of actuarial, empirical data to replace blind faith will be better for the cybersecurity industry in the long run, he added.