You're joking right? I work on a place public software product and over its ~15 year life we've gotten over half of validated vulnerability reports that we have ever had on it within the last year. We basically had to stop feature development for 6 months to burn that down, even with AI providing correct fixes for 80% of the vulnerabilities that were reported.