Companies Are Losing the Web Application Security War
September 29, 2020

Companies are struggling to keep up with rapidly evolving threats and the need to automate security efforts. Attacks against web applications have increased in prevalence to become the single biggest cause of data breaches. As the battlefield shifts more and more from the network to the application, it is important to understand how companies are meeting this challenge.

Verizon's 2020 Data Breach Investigation Report found that 43% of breaches could be traced back to attacks against web applications — more than double the results from last year. Equifax is a high-profile example of a web application data breach that exposed the personal information of 147 million people, costing the company $1.38 billion in settlements and security upgrades.

According to Web Application Security — Enterprises are Losing the War, a report prepared by Acunetix and Dimensional Research, 88% of companies now develop web applications in-house.

Half of the respondents have been successful with their shift-left efforts and include web application security scans with every code build or during unit testing. However, that leaves half that don't scan early enough and may incur major time and resource costs to remediate vulnerabilities. Remarkably, half of the respondents said that vulnerabilities are found faster than they can be fixed, meaning their web applications are open to an attack.

"Companies have moved quickly into building their own software, including customer-facing software that contains sensitive data, but have struggled with the challenge of securing those applications," said Mark Ralls, President and CEO of Acunetix.

Nearly 64% of enterprises still burden specialized security personnel with simple web application security testing that could be automated. And less than half of companies empower developers to run security scans on their own code.

"While companies are definitely making the effort to secure their web applications, with half of companies scanning at each code build and 80% scanning all web applications, 36% of the respondents reported using security testing tools that are inadequate for the job," said Ralls. "It's not enough to check the box on web application security, companies need high-quality dynamic security testing solutions to effectively protect themselves and their customers."

Methodology: Security, DevOps, and C-suite professionals from 382 organizations across the globe participated in the survey.

Share this

Industry News

October 03, 2022

Spectro Cloud announced a major new release of its Palette Edge platform.

October 03, 2022

Arcion announced agentless change data capture (CDC) for all of its supported databases and applications.

September 29, 2022

CloudBees announced the acquisition of ReleaseIQ to expand the company’s DevSecOps capabilities, empowering customers with a low-code, end-to-end release orchestration and visibility solution.

September 29, 2022

SmartBear continues expanding its commitment to the Atlassian Marketplace, adding Bugsnag for Jira and SwaggerHub Integration for Confluence.

Bugsnag developers monitoring application stability and documenting in Jira no longer need to interrupt their workflow to access the app. Developers working in SwaggerHub can use the macro to push API definitions and changes directly to other teams and business stakeholders that work within Confluence. By increasing the presence of SmartBear tools on the Atlassian Marketplace, the company continues meeting developers where they are.

September 29, 2022

Ox Security exited stealth today with $34M in funding led by Evolution Equity Partners, Team8, and M12, Microsoft's venture fund, with participation from Rain Capital.

September 29, 2022

cnvrg.io announced that the new Intel Developer Cloud is now available via the cnvrg.io Metacloud platform, providing a fully integrated software and hardware solution.

September 28, 2022

Kong introduced a number of new performance, security and extensibility features across its entire product portfolio, including major new releases of Kong Gateway, Kong Konnect, Kong Mesh, Kong Insomnia and Kong Ingress Controller, as well as new projects from the Kong Incubator.

September 28, 2022

BroadPeak Partners announced the availability of the new K3 API Connector.

September 28, 2022

Aqua Security announced a new end-to-end software supply chain security solution.

September 27, 2022

DevOps Institute will host SKILup Festival in Singapore on November 15, 2022.

September 27, 2022

Delinea announced the latest release of DevOps Secrets Vault, its high-speed vault for DevOps and DevSecOps teams.

September 27, 2022

The Apptainer community announced version 1.1.0 of the popular container system for secure, high-performance computing (HPC). Improvements in the new version provide a smaller attack surface for production deployments while offering features that improve and simplify the user experience.

September 26, 2022

Secure Code Warrior unveiled Coding Labs, a new mechanism that allows developers to more easily move from learning to applying secure coding knowledge, leading to fewer vulnerabilities in code.

September 26, 2022

ActiveState announced the availability of the ActiveState Artifact Repository.

September 26, 2022

Split Software announced the availability of its Feature Data Platform in the Microsoft Azure Marketplace.