“87% of monitored apps faced attacks in 2026.” That striking figure, published in Digital.ai’s 2026 Application Security Threat Report on May 19, frames a rapid escalation in assaults on customer-facing mobile software that the company links directly to the widespread adoption of AI models since ChatGPT’s launch in November 2022.
Digital.ai’s 2026 Application Security Threat Report: scope and headline findings
Digital.ai said it compiled the report from telemetry gathered across billions of application instances on behalf of clients in financial services, healthcare, automotive, telecommunications and other sectors. The firm reported that 87% of monitored apps were attacked in 2026, up from 55% in 2022. Digital.ai noted that the increase over that period “mirrored the growth in AI model use since ChatGPT launched in November 2022.”
Agentic AI: lowering the skill, time and cost barriers for attackers
Digital.ai argued that “agentic AI is now enabling relatively low-skilled threat actors to achieve in just a few hours what may have taken specialist teams weeks in the past, by accelerating code inspection, exploit generation, and malware adaptation.” The firm’s analysis links AI assistance — in tasks such as reverse engineering and exploit development — to a growing volume and velocity of attacks on apps.
The company’s CEO, Derek Holt, framed the issue starkly: “The same AI developers used to create apps is being used to attack them.” He pressed the operational question for security teams: “Is the application built to defend itself from the moment it hits the store? Or is it waiting for the security team to notice it is being used as the entry point?”
Which app types are most targeted: financial services, automotive, medical devices
Digital.ai identified financial services and automotive apps as the most frequently targeted categories (each 91%), followed closely by medical device apps (86%). The report stressed the stakes: those concentrations put personal finances, vehicles and health data potentially at risk. The firm’s telemetry covered additional sectors, including healthcare and telecommunications, indicating the trend is widespread rather than isolated.
iOS and Android: the parity shift and faster post-store targeting
The report highlighted a rapid narrowing of the historical gap between iOS and Android. Where iOS apps faced around half the volume of attacks as Android in 2023, Digital.ai found that in 2026 iOS apps were attacked at rates nearly equal to Android — 86% versus 89% — with iOS instrumentation attacks growing by 10 percentage points annually. Digital.ai attributed part of this shift to AI-assisted reverse engineering, which it said is making iOS a more popular target and eroding the justification for lower security investment on Apple’s platform.
Digital.ai also noted that “apps are being attacked just hours after appearing in their respective online stores,” a trend that complicates traditional, post-release security checks because the software frequently lives on employee and consumer devices outside enterprise control.
What this means for appsec teams, procurement leaders, and end users
- Technologists and security teams: They face a rapid window between app publication and active exploitation. Holt’s question — whether an app is “built to defend itself from the moment it hits the store” — directly frames the operational decision security teams must make, according to the report.
- Enterprises and procurement leaders: With attacks concentrated in financial services, automotive and medical-device applications, procurement and development choices for those sectors carry elevated risk. The report’s telemetry across billions of instances signals that platform parity (iOS and Android) should be factored into security investment decisions.
- End users: Personal finances, vehicle systems and health data were highlighted as potentially at risk where targeted apps are compromised, reflecting the categories that Digital.ai’s data shows are most frequently attacked.
Digital.ai’s findings underline a stark operational reality: attackers are using AI to compress time and expertise, and apps can be exposed within hours of publication. As Derek Holt put it, “The gap between where the attacks are and where the security investment is, is no longer acceptable.” That admonition leaves a clear prompt for organizations that publish or depend on mobile applications — either shift security left and harden apps before store release, or accept that threat actors will keep exploiting the opening.
