Developer security skills in the age of AI-generated fixes

SecureFlag analyzed 805,663 hands-on lab attempts across the OWASP Top 10 (2021), spanning 1,393 unique security labs in more than 20 technologies, from Java, Python, and Go to cloud, container, and AI/LLM application security. The data was collected between 2024 and 2026 and looks at how developers solve real vulnerability classes when given structured training and immediate feedback.

The report breaks down solve rates, hint usage, average attempts, and the range of correct fixes for each OWASP category, and shows why Broken Access Control and Software and Data Integrity Failures remain the two hardest areas to get right. It offers a data-driven look at where developer security skills are strong and where they are not, with practical takeaways for organizations that increasingly rely on AI tools to generate security fixes.