Orgs Doing More App Security Testing but Fixing Fewer Vulns

On average, US organizations took nearly five months to fix critical vulnerabilities according to WhiteHat Securitys annual vulnerability report.

Enterprise organizations are scanning more applications for security vulnerabilities than ever before, but, troublingly, they are remediating fewer of their discoveries because of the sheer volume.
As it has for the past 13 years, WhiteHat Security recently analyzed data from the results of application security tests the company performed at customer locations last year.
The analysis showed that US organizations tested 20% more applications last year for security issues than they did in 2017. Yet they remediated barely half (50.7%) of all critical vulnerabilities discovered in their application software during dynamic application security tests (DAST) in 2018 and just 37% of the high severity flaws.
Despite higher awareness of application security issues, the vulnerability remediation rates last year were actually lower than those reported in 2017 (nearly 57% and 46%, respectively) — which, in turn, was lower than the prior year.
The overall average number of critical vulnerabilities per website was 3.2 — about the same as it has been in the past three years. Information technologies companies ironically had more than double that, at seven critical vulnerabilities per site. Others with an above-average number of critical vulnerabilities on their websites included organizations in the manufacturing sector, with 6.7, retail organizations (6.9) and mining (7).
On average, US organizations took nearly 149 days, or about five months, to fix critical vulnerabilities and some 235 days to fix the ones deemed of high importance. The window of exposure — or the length of time that an application has a serious vulnerability that can be exploited — was especially worrisome among organizations in the IT and retail sectors.
WhiteHats
data
showed that a startling 56.9% of applications in IT organizations and 55.4% of those at companies in the retail sector were always vulnerable to attack.
Suboptimal State
The state of application security continues to be suboptimal, says Setu Kulkarni, vice president of corporate strategy at WhiteHat Security. While this is not unexpected, it is surprising given that the number of applications and their criticality is increasing at an unprecedented rate.
Web application security has become a top concern for enterprise organizations. Many recent breaches have resulted from attackers exploiting security flaws in Web applications. A DevSecOps community study that
Sonatype
conducted earlier this year, in fact, showed that more than one in four organizations (26%) have already experienced a data breach because of a Web application security issue.
In many cases, Sonatype found that the breaches were tied to inherited vulnerabilities in open source and third-party components that software development organizations frequently use in their applications.
WhiteHats study showed that such embeddable components were responsible for one-third of all discovered application security vulnerabilities last year. The biggest risk to organizations was from using unpatched third-party libraries, which increased 50% in number in just the past year.
As companies are chasing shorter time to market, theyre relying more on open source and third-party components, Kulkarni says. Consequently, production apps are inheriting significant risks. Organizations need to perform more software composition analysis [SCA] to identify these inherited vulnerabilities before apps are moved into production, he says.
One big takeaway from WhiteHats report is that companies that implement DevSecOps practices tend to fare significantly better than those that dont. For instance, organizations using a DevSecOps approach had a much higher critical vulnerability remediation rate (89%) compared with companies without one (50.7%).
Only about 22% of the applications in organizations with a formal DevSecOps approach were always vulnerable to threats, compared with 50% of apps, on average, for organizations that didnt use the approach. Similarly, the average time to fix critical vulnerabilities was 22 days in organizations that had implemented DevSecOps, comparedwith 149 days in other organizations.
The organizations that succeeded in improving their security posture last year are the ones that embraced a robust, phased DevSecOps approach, Kulkarni says.
In such organizations application security testing is embedded into each stage of the development life cycle, he notes. Five years ago, such DevSecOps practices were still more philosophy than practical.
Now we see it being built into best practices and processes that are measurable and helping organizations improve their security posture, he notes.
Related Content:
A New Approach to Application Security Testing
Taming the Chaos of Application Security: We Built an App for That
Web App Vulnerabilities Flying Under Your Radar
2019 Pwnie Award Winners (And Those Who Wish They Werent)

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Orgs Doing More App Security Testing but Fixing Fewer Vulns