Code activity has become a baseline part of modern engineering. In 2024, 2.6 billion people used software developer tools, and CVE counts rose to more than 25,000 in 2023. The same period also found 65% of web applications vulnerable to injection, linking day-to-day development practices with measurable security risk.
Key Takeaways
- 2.6 billion people worldwide used software developer tools in 2024, reflecting widespread developer activity and the need for code-centric tooling
- 25% of developers reported using Rust in 2024 Stack Overflow survey results, showing adoption of newer systems languages
- 71% of organizations reported using containers in production environments in 2024 (Kubernetes and containers adoption survey data), supporting modern code deployment workflows
- 72% of enterprises reported having a formal SDLC policy by 2024, indicating more structured code development governance
- The US government required SBOMs for certain federal software acquisitions starting from FY2022 under executive and procurement guidance
- US$ 1.8 trillion is the estimated global spending on software and IT services in 2024 (industry spending baseline including code-dependent spend)
- In the U.S., the average cost of a data breach was $4.45 million (2023 IBM Cost of a Data Breach report), showing the financial impact of insecure or vulnerable code
- The global application development software market was valued at $24.1 billion in 2024 and is forecast to grow through 2029 (code-centric tooling category)
- US$ 9.6 billion global market size for DevOps tooling in 2024 (forecast based estimates), reflecting demand around code automation and pipelines
- NIST SP 800-218 defines 42 activities in SSDF; organizations can map these to secure code practices
- 51% of engineering teams reported using automated tests to reduce release risk in 2024 (State of DevOps survey findings)
- According to OWASP Top 10 (2021), 65% of web applications were vulnerable to injection in common assessments (as reported in OWASP background references)
- The Veracode 2024 State of Software Security Report found that 73% of applications had at least one security flaw on average
- 76% of organizations said software supply chain security (SCA/SBOM/dependency controls) is critical to their security posture (2024)
- 29% of organizations reported experiencing a software-related security incident within the past 12 months (2023)
From rising DevOps and container use to tougher security demands like SBOMs and dependency flaws, software code keeps evolving fast.
Related reading
01 · Category
User Adoption2 stats
01
2.6 billion people worldwide used software developer tools in 2024, reflecting widespread developer activity and the need for code-centric tooling
02
25% of developers reported using Rust in 2024 Stack Overflow survey results, showing adoption of newer systems languages
Interpretation
User Adoption Interpretation
In 2024, 2.6 billion people used software developer tools and 25% of developers reported using Rust, signaling strong user adoption across the developer community with growing interest in newer programming languages.
02 · Category
Industry Trends14 stats
01
71% of organizations reported using containers in production environments in 2024 (Kubernetes and containers adoption survey data), supporting modern code deployment workflows
02
72% of enterprises reported having a formal SDLC policy by 2024, indicating more structured code development governance
03
The US government required SBOMs for certain federal software acquisitions starting from FY2022 under executive and procurement guidance
04
CISA reported that SBOM usage helps reduce response time during security incidents (SBOM guidance impacts)
05
OpenAI’s Codex research reported an average 28% pass rate improvement on programming tasks versus baseline models (from paper results)
06
DeepMind’s AlphaCode achieved a score of 5/100 for passing tasks in the competition benchmark, demonstrating AI coding challenges
07
The number of CVEs increased to over 25,000 in 2023 (annual count from CVE Program / NVD), reflecting code-related vulnerability volume
08
1.4 billion people worldwide used social media platforms in 2019; time series growth enabled large-scale code infrastructure ecosystems (context for software ecosystem spending)
09
52% of global organizations use AWS services for production workloads (2024 cloud survey)
10
64% of software teams reported adopting feature flags to reduce deployment risk (2023)
11
9.8% of all computers worldwide ran Windows 11 in December 2023, reflecting ongoing software platform evolution that drives continual code changes
12
4.8 exaFLOPS is the peak performance of Frontier (operational), showing extreme-scale computing workloads that depend on large, continuously evolving software stacks
13
62% of organizations report using containers in production (2023), indicating widespread deployment of code artifacts in orchestrated environments
14
In 2023, the U.S. government reported 5,174 publicly reported security incidents affecting federal organizations under incident reporting requirements, highlighting operational pressure on secure coding and patching
Interpretation
Industry Trends Interpretation
Across industry trends in software development, 71% of organizations were using containers in production in 2024 while 72% reported having a formal SDLC policy, signaling that governance and modern deployment practices are increasingly being adopted together to manage the faster pace of code change and security risk.
03 · Category
Cost Analysis2 stats
01
US$ 1.8 trillion is the estimated global spending on software and IT services in 2024 (industry spending baseline including code-dependent spend)
02
In the U.S., the average cost of a data breach was $4.45 million (2023 IBM Cost of a Data Breach report), showing the financial impact of insecure or vulnerable code
Interpretation
Cost Analysis Interpretation
Cost analysis shows that global spending on software and IT services is projected to reach $1.8 trillion in 2024 while the U.S. average cost of a data breach is $4.45 million, underscoring how vulnerable code can create enormous financial downside within those massive IT budgets.
04 · Category
Market Size3 stats
01
The global application development software market was valued at $24.1 billion in 2024 and is forecast to grow through 2029 (code-centric tooling category)
02
US$ 9.6 billion global market size for DevOps tooling in 2024 (forecast based estimates), reflecting demand around code automation and pipelines
03
NIST SP 800-218 defines 42 activities in SSDF; organizations can map these to secure code practices
Interpretation
Market Size Interpretation
For the Market Size angle, the market for code-centric application development software is already $24.1 billion in 2024 and is set to keep expanding through 2029, while DevOps tooling at $9.6 billion in 2024 signals strong and growing demand for code automation and pipelines.
05 · Category
Performance Metrics6 stats
01
51% of engineering teams reported using automated tests to reduce release risk in 2024 (State of DevOps survey findings)
02
According to OWASP Top 10 (2021), 65% of web applications were vulnerable to injection in common assessments (as reported in OWASP background references)
03
The Veracode 2024 State of Software Security Report found that 73% of applications had at least one security flaw on average
04
42% of vulnerabilities in applications were found in the composition (dependencies) per a recent report from Snyk (dependency scanning results)
05
CVSS v3.1 has 7 severity metric levels (including Critical, High, Medium, Low), used to prioritize code vulnerabilities
06
Google’s Code Search research (2015) found that 60% of vulnerabilities are introduced by new code, emphasizing the importance of secure coding practices that improve code quality metrics
Interpretation
Performance Metrics Interpretation
Performance-focused teams are seeing that reducing risk and improving code quality hinges on prevention and early detection, since 60% of vulnerabilities are introduced by new code and 42% are found in dependencies, even as 51% use automated tests to lower release risk.
More related reading
06 · Category
Security & Compliance3 stats
01
76% of organizations said software supply chain security (SCA/SBOM/dependency controls) is critical to their security posture (2024)
02
29% of organizations reported experiencing a software-related security incident within the past 12 months (2023)
03
73% of organizations reported they use container images from a private registry (2024)
Interpretation
Security & Compliance Interpretation
Security and Compliance teams are increasingly focused on reducing real-world risk, since 76% of organizations say software supply chain security is critical and 29% experienced a software-related security incident in the past 12 months.
07 · Category
Reliability & Quality2 stats
01
40% of developers said they have experienced production outages caused by code changes (2023)
02
2.5x faster deployment frequency is associated with organizations adopting DevOps practices (DORA research; reported as part of Accelerate/State of DevOps findings)
Interpretation
Reliability & Quality Interpretation
For Reliability and Quality, the fact that 40% of developers report production outages from code changes shows how risky releases can be without strong safeguards, while the 2.5x higher deployment frequency seen with DevOps adoption suggests better delivery practices can help improve quality outcomes.
08 · Category
Developer Productivity2 stats
01
52% of developers reported using AI tools to assist with coding tasks (2024)
02
41% of developers reported that documentation is a major pain point during implementation (2023)
Interpretation
Developer Productivity Interpretation
For Developer Productivity, AI adoption is rising with 52% of developers using AI tools for coding, but documentation remains a major implementation pain point for 41% of developers, suggesting the biggest productivity gains may require pairing AI assistance with better documentation.
09 · Category
Market Economics6 stats
01
$21.1 billion was the global spend on software development tools in 2024 (market estimate)
02
$4.6 billion global market size for software composition analysis (SCA) in 2024 (forecast market estimate)
03
$1.9 billion was the global market size for code security testing in 2024 (vendor research market estimate)
04
$8.3 billion global market size for application security testing in 2024 (market estimate)
05
$6.2 billion global market size for API management in 2024 (market estimate)
06
$7.9 billion global market size for developer experience tools in 2024 (market estimate)
Interpretation
Market Economics Interpretation
The Market Economics picture shows strong and steady demand across the software lifecycle, with 2024 spend reaching $21.1 billion on software development tools and security and quality categories growing in parallel, such as $8.3 billion for application security testing, $1.9 billion for code security testing, and $4.6 billion for software composition analysis.
report visual · Comparison
How widespread modern software development practices are
In 2023–2024, major engineering and infrastructure practices—containers, SDLC governance, testing, and AI coding assistance—were reported as common across organizations and developers.
Enterprises with formal SDLC policy (by 2024)72%
Organizations using containers in production (2024)71%
Software teams adopting feature flags (2023)64%
Developers using AI tools to assist coding (2024)52%
Engineering teams using automated tests (2024)51%
source-verifieddatadoghq.com · gartner.com · devops.com · insights.stackoverflow.com · launchdarkly.com2024
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Nathan Caldwell. (2026, February 13). Code Statistics. Gitnux. https://gitnux.org/code-statistics
MLA
Nathan Caldwell. "Code Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/code-statistics.
Chicago
Nathan Caldwell. 2026. "Code Statistics." Gitnux. https://gitnux.org/code-statistics.
Sources & references
40 datasets cited across this report · attribution is report-level
+5 additional datasets cited (not shown individually)