Vulnerable Web Applications Make Web Developers an Easy Target - Even Behind a Firewall
August 03, 2017

Ferruh Mavituna
Netsparker

Most software developers make themselves easy targets for hackers, even when they are behind a corporate firewall, according to a new survey from Netsparker Ltd.

The primary reason is not that their web server software is out of date, however. Instead, it is largely the result of developers running vulnerable web applications on their computers even when they are protected by a firewall, therefore jeopardizing a corporation's network and data.

While firewalls are essential for security and protecting sensitive data, they are not a one-fix solution for vulnerable web applications. Unfortunately, many assume that security measures like firewalls are enough to prevent “bad actors” from getting inside a developer’s web browser.

The survey of US-based software developers, sampled from a broad cross-section of vertical markets, government entities and organization sizes, found:

■ 81 percent of respondents run their software on a web server

■ 89 percent claimed they keep their web server software up to date

■ 52 percent say they run vulnerable/undeveloped web applications on their server

■ 55 percent are running web apps in development on servers directly connected to the internet

■ 32 percent admitted to hardening the web applications on their test environment

These statistics should be no surprise to anyone. Yes, developers are patching their web servers, but they are still running vulnerable web applications, which is what makes them a target.

Fifty-two percent admit that they run vulnerable half-developed web applications on their web server. That’s worrisome, especially since 55 percent claim that these same web applications can be connected directly to the internet.

The survey findings illustrate the reality that enterprises approach securing their digital assets based on a holistic approach focusing on value creation, testing and dissemination processes. Indeed, while much web security and broader IT risk management attention is paid to the protection of the web servers, the failure to address vulnerabilities in software development processes and practices poses as much, if not greater, risks.

About the Survey: Propeller Insights conducted the recent survey of web developers for Netsparker from July 5-7, 2017.

Ferruh Mavituna is CEO of Netsparker Ltd.
Share this

Industry News

June 16, 2025

Operant AI announced the launch of MCP Gateway, an expansion of its flagship AI Gatekeeper™ platform, that delivers comprehensive security for Model Context Protocol (MCP) applications.

June 12, 2025

Oracle has expanded its collaboration with NVIDIA to help customers streamline the development and deployment of production-ready AI, develop and run next-generation reasoning models and AI agents, and access the computing resources needed to further accelerate AI innovation.

June 12, 2025

Datadog launched its Internal Developer Portal (IDP) built on live observability data.

June 12, 2025

Azul and Chainguard announced a strategic partnership that will unite Azul’s commercial support and curated OpenJDK distributions with Chainguard’s Linux distro, software factory and container images.

June 11, 2025

SmartBear launched Reflect Mobile featuring HaloAI, expanding its no-code, GenAI-powered test automation platform to include native mobile apps.

June 11, 2025

ArmorCode announced the launch of AI Code Insights.

June 11, 2025

Codiac announced the release of Codiac 2.5, a major update to its unified automation platform for container orchestration and Kubernetes management.

June 10, 2025

Harness Internal Developer Portal (IDP) is releasing major upgrades and new features built to address challenges developers face daily, ultimately giving them more time back for innovation.

June 10, 2025

Azul announced an enhancement to Azul Intelligence Cloud, a breakthrough capability in Azul Vulnerability Detection that brings precision to detection of Java application security vulnerabilities.

June 10, 2025

ZEST Security announced its strategic integration with Upwind, giving DevOps and Security teams real-time, runtime powered cloud visibility combined with intelligent, Agentic AI-driven remediation.

June 09, 2025

Google announced an upgraded preview of Gemini 2.5 Pro, its most intelligent model yet.

June 09, 2025

iTmethods and Coder have partnered to bring enterprises a new way to deploy secure, high-performance and AI-ready Cloud Development Environments (CDEs).

June 09, 2025

Gearset announced the expansion of its new Observability functionality to include Flow and Apex error monitoring.

June 05, 2025

Postman announced new capabilities that make it dramatically easier to design, test, deploy, and monitor AI agents and the APIs they rely on.