New Research Reveals Companies Are Losing the Web Application Security War

Half of organizations say that vulnerabilities are found faster than they can be fixed

AUSTIN, Texas – Sept. 22, 2020 – Acunetix, a global leader in automated web application security testing, teamed up with Dimensional Research to learn how effectively companies are handling web application security. Security, DevOps, and C-suite professionals from 382 organizations across the globe responded to the survey; Acunetix analyzed the findings and today released a report, “Web Application Security – Enterprises are Losing the War.”

Companies are struggling to keep up with rapidly evolving threats and the need to automate security efforts. Attacks against web applications have increased in prevalence to become the single biggest cause of data breaches. As the battlefield shifts more and more from the network to the application, it is important to understand how companies are meeting this challenge.

Verizon’s 2020 Data Breach Investigation Report (DBIR), found that 43% of breaches could be traced back to attacks against web applications – more than double the results from last year. Equifax is a high-profile example of a web application data breach that exposed the personal information of 147 million people, costing the company $1.38 billion in settlements and security upgrades.

According to the Acunetix report, 88% of companies now develop web applications in-house. Half of the respondents have been successful with their shift-left efforts and include web application security scans with every code build or during unit testing. However, that leaves half that don’t scan early enough and may incur major time and resource costs to remediate vulnerabilities. Remarkably, half of the respondents said that vulnerabilities are found faster than they can be fixed, meaning their web applications are open to an attack.

“Companies have moved quickly into building their own software, including customer-facing software that contains sensitive data, but have struggled with the challenge of securing those applications,” said Mark Ralls, President and CEO of Acunetix.

Nearly 64% of enterprises still burden specialized security personnel with simple web application security testing that could be automated. And less than half of companies empower developers to run security scans on their own code.

“While companies are definitely making the effort to secure their web applications, with half of companies scanning at each code build and 80% scanning all web applications, 36% of the respondents reported using security testing tools that are inadequate for the job,” said Ralls. “It’s not enough to check the box on web application security, companies need high-quality dynamic security testing solutions to effectively protect themselves and their customers.”

About Acunetix

Over 3,000 companies worldwide trust Acunetix to protect their assets, align with their policies, and integrate with the development lifecycle. Acunetix brings an extensive feature set of automated penetration testing tools, enabling security analysts to perform a complete vulnerability assessment and repair detected issues. The company counts many Fortune 500 companies among its customers, including organizations from the banking, education, healthcare, government, defense, and technology industries. Acunetix is part of Invicti Security, the leading global provider of dynamic application security testing products. For more information visit https://www.acunetix.com.