Digital Transformation and the Shadow Code Risk
September 23, 2020

Ameet Naik
PerimeterX

Businesses across the world are accelerating their digital transformation as consumers increasingly shift to online channels. Web applications have become a critical element of this digital journey and keeping them secure and performant is now more important than ever. However, there are new challenges that application developers face while delivering and maintaining these business-critical applications.

Web application developers often rely on open source libraries and third-party scripts in order to innovate faster and keep pace with evolving business needs. These scripts and libraries — often added without approvals or security validation — introduce hidden risks into the organization and make it challenging to ensure data privacy and to comply with regulations.

Collectively referred to as "Shadow Code," these scripts provide essential services such as payments, analytics, chatbots, advertising or social media integrations. However, application security teams often don't have a comprehensive understanding of what these scripts actually do, creating opportunities for malicious code injection attacks.


The Client-Side Blind Side

Often introduced without any formal approval process or security validation, these scripts run on the client side, which means traditional monitoring and security tools cannot provide the same visibility and control that you might have over server-side apps. This is a major blind side for appsec teams. So how big is this problem?

PerimeterX, in conjunction with Osterman Research, completed the second annual survey of application security professionals to uncover the extent and impact of Shadow Code across organizations in a diverse set of industries. The report, Shadow Code: The Hidden Risk to Your Website, finds that only 8% of respondents have complete insights into the third-party code running on their website. This is a very low result, which means that the vast majority of web applications out there have high levels of Shadow Code running on them.

The Trust Deficit

Given the extensive amount of third-party code running on web applications, the survey also examined the relationship between the users and the providers of third-party scripts. Over 30% of the respondents reported that they do not trust the providers of their third-party scripts. Yet, they allow this Shadow Code to run on the client-side of their web applications. This poses considerable business risk to the owners of these web applications.

As data privacy regulations like the California Consumer Privacy Act (CCPA) and the Global Data Protection Regulation (GDPR) impose strict penalties for client-side data breaches running into the hundreds of millions of dollars, application owners need to be more vigilant about the security of third-party scripts on their web applications.

The survey found that only 30% of survey respondents believed that their externally-facing web properties are completely secure from threats like Magecart attacks, down from about 40% in the 2019 survey.

Limited Controls

Application owners are turning to client-side behavioral analysis solutions that can baseline the behavior of first- and third-party scripts to identify anomalies that could signal a compromise. However, they need more mitigation options when dealing with such threats.

Only 22% of the survey respondents indicated that they or their teams have the full authority to shut down any suspicious script that they might find running on their website. This is down from 32% in 2019. For example, if the anomalous script processes payments, it's very difficult to shut it down while the team analyzes the root cause. Solutions that can surgically stop specific script actions without shutting down the entire script can offer a useful middle ground to already constrained appsec teams.

Compliance Remains Elusive

Only 30% of respondents to the survey reported that their externally facing web properties are secure and thus compliant with data privacy regulations. These statistics suggest that we are at the very early stages of identifying and grappling with the Shadow Code problem.

Much like with Shadow IT, when CIOs were forced to implement BYO device policies and tolerate more cloud services and apps in use than they could imagine, CISOs no longer have the luxury of saying no to third-party code. Meanwhile data privacy regulations are tightening worldwide and client-side attacks, such as Magecart, are on the rise, leading to massive data breaches and fines.

Shadow Code Best Practices

Shadow Code is here to stay and eliminating third-party scripts is not the answer. Application development and security teams can gain control over this problem by combining static testing of internal code, with runtime behavioral analysis of third-party scripts that can identify security risks in real time. Client-side application security solutions can offer a wide range of mitigation options to manage threats present within Shadow Code. Web applications can continue to benefit from the vast ecosystem of third-party services without compromising their users' data privacy.

Ameet Naik is a Security Evangelist at PerimeterX
Share this

Industry News

May 01, 2025

Check Point® Software Technologies Ltd.(link is external) announced that its Quantum Firewall Software R82 — the latest version of Check Point’s core network security software delivering advanced threat prevention and scalable policy management — has received Common Criteria EAL4+ certification, further reinforcing its position as a trusted security foundation for critical infrastructure, government, and defense organizations worldwide.

May 01, 2025

Postman announced full support for the Model Context Protocol (MCP), helping users build better AI Agents, faster.

May 01, 2025

Opsera announced new Advanced Security Dashboard capabilities available as an extension of Opsera's Unified Insights for GitHub Copilot.

May 01, 2025

Lineaje launched new capabilities including Lineaje agentic AI-powered self-healing agents that autonomously secure open-source software, source code and containers, Gold Open Source Packages and Gold Open Source Images that enable organizations to source trusted, pre-fixed open-source software, and a software crawling and analysis engine, SCA360, that discovers and contextualizes risks at all software development stages.

April 30, 2025

Lenses.io announced the release of Lenses 6.0, enabling organizations to modernize applications and systems with real-time data as AI adoption accelerates.

April 30, 2025

Sonata Software has achieved Amazon Web Services (AWS) DevOps Competency status.

April 29, 2025

vFunction® announced significant platform advancements that reduce complexity across the architectural spectrum and target the growing disconnect between development speed and architectural integrity.

April 29, 2025

Sonatype® introduced major enhancements to Repository Firewall that expand proactive malware protection across the enterprise — from developer workstations to the network edge.

April 29, 2025

Aqua Security introduced Secure AI, full lifecycle security from code to cloud to prompt.

April 29, 2025

Salt Security announced the launch of the Salt Model Context Protocol (MCP) Server, giving enterprise teams a novel access point of interaction with their API infrastructure, leveraging natural language and artificial intelligence (AI).

April 28, 2025

The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, announced the graduation of in-toto, a software supply chain security framework developed at the NYU Tandon School of Engineering.

April 28, 2025

SnapLogic announced the launch of its next-generation API management (APIM) solution, helping organizations accelerate their journey to a composable and agentic enterprise.

April 28, 2025

Apiiro announced Software Graph Visualization, an interactive map that enables users to visualize their software architectures across all components, vulnerabilities, toxic combinations, blast radius, data exposure and material changes in real time.

April 24, 2025

Check Point® Software Technologies Ltd.(link is external) and Illumio, the breach containment company, announced a strategic partnership to help organizations strengthen security and advance their Zero Trust posture.