AppSec teams are stuck in a catch-up cycle, unable to keep up with the increasingly rapid, agile dev pace, and playing security defense via an endless and unproductive vulnerability chase, according to Backslash Security.
Costly ‘defensive tax’
Notably, 58% of respondents report spending over 50% of their time chasing vulnerabilities, with a shocking 89% spending at least 25% of their time in this defensive mode.
Far and wide, enterprises are victims of this costly ‘defensive tax:’ the cost of employing AppSec engineers who chase vulnerabilities rather than drive a comprehensive cloud-native AppSec program is estimated to be upwards of $1.2 million annually.
AppSec technologies issues
Given the accelerated pace of digital innovation across enterprises of all sizes and the blurred lines between AppSec and CloudSec, enterprise AppSec teams are saddled with solutions that have not caught up to the cloud pace. As a result, AppSec professionals are losing faith in the prevailing AppSec tools:
- Almost all organizations are seeing a widespread impact of the lack of cloud-native AppSec tools, including growing friction between AppSec and dev teams (39%), jeopardized ability to generate revenue (39%) and inability to retain high-value dev talent (38%) and AppSec talent (35%);
- 94% of respondents cited multiple issues with today’s AppSec technologies; top complaints were the considerable amount of time spent prioritizing findings (48%) and that existing AppSec tools are noisy (45%).
- SAST and DAST are quickly losing ground, with just 32% of respondents stating that they use either of these prevailing standards extensively;
Three key tenets of modern AppSec
The report emphasizes the urgent need for a new AppSec paradigm that maps a clear path to a modern standard for cloud-native AppSec success, characterized by end-to-end visualization of all microservices, automatic identification and prioritization of real risks, and intelligent triaging and remediation.
In assessing the importance of these three key tenets of modern AppSec:
- 82% agree that automating threat model visualization will help AppSec Teams save time and manual labor analyzing cloud-native application risks;
- 91% believe correlating application security risks with the application’s exposure to the outside world, such as via open APIs, is important;
- 91% believe differentiating between general code weaknesses and critical vulnerabilities is important;
- Eight out of the nine total capabilities that define this new cloud-native AppSec paradigm were ranked as “critical” or “important” by 70%+ of respondents.
Outdated AppSec methodologies hamper productivity
However, the AppSec industry suffers from a massive cloud-native enablement gap. Across all of the most critical capabilities, respondents reported that enablement is sorely lacking:
- 85% of respondents say the ability to differentiate between real risks and noise is critical to their success, making it the #1 most important capability; yet only 38% of respondents are enabled to do so;
- This trend persists throughout, including “correlating security findings to the developer or dev team responsible for the fix” (78% vs. 43%); “meeting compliance standards” (78% vs. 38%); and “efficient triaging between Dev and AppSec” (73% vs. 42%).
“What we’re hearing across the board is a message of urgency – we’ve entered a new, cloud-native reality, and it’s time to put an end to the AppSec catch-up game,” said Shahar Man, CEO of Backslash.
“These outdated AppSec methodologies hamper productivity, innovation and talent retention for both AppSec and dev teams. The cloud-native application development paradigm calls for a new, unified approach to application security that will make the friction between development and AppSec teams a thing of the past, enable enterprises to retain valuable talent, and accelerate innovation and growth,” added Man.