MA-VERACODE
29.5.2024 14:31:31 CEST | Business Wire | Press release
Veracode, a global leader in application risk management, today released research revealing applications developed by public sector organizations have more security debt than those created by the private sector. Security debt, defined for this report as flaws that remain unfixed for longer than a year, exists in 59 percent of applications in the public sector, compared to the overall rate of 42 percent. The research analyzed public sector organizations in more than 25 countries across the globe.
This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20240529282258/en/
Figure 2: Security Debt in Public Sector Applications (Graphic: Business Wire)
“Decades of accumulated security debt in unpatched software and poor security configurations, are in the applications that serve our government,” said Chris Eng, Chief Research Officer at Veracode. “Without a systematic and continuous approach to finding and fixing security flaws, the public sector is left dangerously exposed to attacks from hackers.”
Federal government systems are increasingly under cyberattack, as malicious criminals target public sector organizations with more damaging and disruptive techniques. In response, the federal government is enforcing a flurry of initiatives to strengthen cybersecurity, including efforts to reduce risk in the applications that serve the government. In March of 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) released the Secure Software Development Attestation Form to hold providers to the federal government accountable for insecure software.
Veracode researchers found that while slightly fewer public sector organizations (68 percent) have security debt than other industries (71 percent), they tend to accumulate more of it. Only three percent of applications are flaw-free, compared to six percent across other industries. Even more concerning, 40 percent of public sector entities have persistent, high-severity flaws that constitute ‘critical’ security debt, which would put the confidentiality, integrity, and availability of businesses at serious risk if exploited.
“The good news is that most organizations have the capacity to remediate all critical debt, but risk prioritization is key,” said Eng. “Two-thirds of all flaws in public sector organizations are either less than one year old or are not critical in severity. In addition, less than one percent of all flaws constitute critical security debt. By prioritizing that security debt with focused effort, organizations can achieve maximum risk reduction and then move to address non-critical flaws based on their risk tolerance and capabilities.”
According to the report, security debt in the public sector primarily affects first-party code (93 percent), but most of the critical security debt comes from third-party dependencies (55.5 percent). This reinforces the importance of the Open Source Security Software Initiative (OS3I), an inter-agency working group focused on ensuring open-source software is “as safe, secure and sustainable as it is open.” It also emphasizes the need for organizations to focus on both first- and third-party code to effectively reduce security debt.
The analysis further shows security debt in the public sector is primarily concentrated in older, larger applications (22 percent). This is especially true for critical security debt (30 percent), confirming a correlation between application age and the accumulation of security debt. Researchers also compared the security debt profile for different development languages and found that Java and .NET applications stand out as significant sources of debt in the public sector.
“The current state of software security in the public sector reinforces the importance of making secure by design a standard approach for the whole network connected world,” closed Eng. “We applaud CISA’s recent announcement of its Secure by Design Pledge and are proud to be one of the inaugural signatories. Our goal with this research is to further support our government and industry partners in promoting widespread adoption of these principles.”
The full State of Software Security Public Sector 2024 report is available to download on the Veracode website.
About the State of Software Security Report
The Veracode State of Software Security 2024 report analyzed data from large and small companies, commercial software suppliers, software outsourcers, and open-source projects. The research draws from more than a million (1,007,133) applications across all scan types, 1,553,022 dynamic analysis scans, and 11,429,365 static analysis scans. All those scans produced 96 million raw static findings, 4 million raw dynamic findings, and 12.2 million raw software composition analysis findings.
About Veracode
Veracode is a global leader in Application Risk Management for the AI era. Powered by trillions of lines of code scans and a proprietary AI-assisted remediation engine, the Veracode platform is trusted by organizations worldwide to build and maintain secure software from code creation to cloud deployment. Thousands of the world’s leading development and security teams use Veracode every second of every day to get accurate, actionable visibility of exploitable risk, achieve real-time vulnerability remediation, and reduce their security debt at scale. Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, and Penetration Testing.
Learn more at www.veracode.com, on the Veracode blog, and on LinkedIn and X.
Copyright © 2024 Veracode, Inc. All rights reserved. Veracode is a registered trademark of Veracode, Inc. in the United States and may be registered in certain other jurisdictions. All other product names, brands or logos belong to their respective holders. All other trademarks cited herein are property of their respective owners.
To view this piece of content from cts.businesswire.com, please give your consent at the top of this page.
View source version on businesswire.com: https://www.businesswire.com/news/home/20240529282258/en/
About Business Wire
Subscribe to releases from Business Wire
Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.
Latest releases from Business Wire
Fortegra Appoints Iwan Röpcke as Chief Executive Officer, Belgium8.5.2026 09:30:00 CEST | Press release
The Fortegra Group, Inc., a global specialty insurer, today announced the appointment of Iwan Röpcke as Chief Executive Officer, Belgium. Mr. Röpcke brings more than 25 years of insurance industry experience to the role, spanning broking, commercial leadership, and executive management across the Benelux and broader European markets. He joins Fortegra from Lloyd’s Insurance Company S.A., where he served as Country Manager for Belgium and the Netherlands, building out the operation from its early stages and overseeing both business strategy and development. Prior to Lloyd's, Mr. Röpcke held senior leadership positions at Willis Towers Watson (via Gras Savoye), where he served as Head of Sales and Head of the Competence Center. His career also includes roles at Inter Partner Assistance (AXA Assistance) as Commercial Director Benelux, Winterthur Europe Assurances, AIG Europe, Aon Belgium, and Marsh. Mr. Röpcke’s industry expertise spans a range of specialty risk areas, with deep relations
KAYTUS Launches All-QLC Flash Storage at AI EXPO 2026 for 10,000-GPU Clusters8.5.2026 09:02:00 CEST | Press release
KAYTUS’s next-generation all-QLC flash solution delivers fully linear performance scaling for massive GPU clusters, while reducing TCO by 70%, enabling ultra-large-scale computing for the era of agentic AI. At AI EXPO KOREA 2026, KAYTUS officially launched its All-QLC Flash Storage Solution, engineered to deliver high performance, massive scalability, and cost efficiency for 10,000-GPU clusters. The solution addresses data-delivery bottlenecks in ultra-large-scale AI training, helping maximize GPU resource utilization. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260508313130/en/ Based on the KR2280 and KR1180 server platforms, the solution is deeply integrated with industry-leading AI-native parallel file systems to eliminate data silos inherent in traditional tiered storage. Purpose-built for read-intensive AI workloads, it overcomes the horizontal scaling limitations of massive clusters. Verified test-data shows that, a
Beneq Appoints Dr. Jason Harrison as Chief Executive Officer8.5.2026 09:00:00 CEST | Press release
Semiconductor industry leader takes the helm to accelerate Beneq’s next phase of growth in atomic layer deposition Beneq Oy, the home of atomic layer deposition (ALD), today announced the appointment of Dr. Jason Harrison as Chief Executive Officer. Dr. Harrison succeeds Dr. Tommi Vainio and will lead Beneq into its next phase of growth across semiconductor, optical, and emerging technology markets. A Strategic Leadership Transition Beneq enters its next phase of growth from a position of strong commercial momentum. Recent milestones include the qualification of the Beneq Transform® cluster tool for volume production of GaN power and RF filter devices; the introduction of Beneq Transmute™ and Beneq Transform® XP, both engineered for high-volume manufacturing (HVM) of specialty semiconductors; growing adoption of the P-Series for coating critical chamber parts in advanced node devices; and selection of the C2R™ for AR waveguide production in next-generation XR optics. Against this backd
World Employment Confederation’s 59th Annual Conference to Address Critical Global Labour Market Concerns8.5.2026 07:12:00 CEST | Press release
Senior leaders from policy, business and international institutions are set to discuss critical labour market concerns at the World Employment Confederation’s Annual Conference, during an era of global transformation and disruption never-before-seen. Taking place on 12-13 May in Toronto and entitled ‘Grow With Talent’, this year’s World Employment Conference – co-organised with ACSESS – arrives at a time of profound economic uncertainty. This gathering of leaders and experts will help define the path forward for the global labour market and set the stage for discussions at the 114th Session of the International Labour Conference (ILC) in June. Bettina Schaller, President of World Employment Confederation (WEC) says: “The question at the heart of this year’s World Employment Conference is: how will we mobilise the world’s talent to drive growth in an era of disruption?At a time of accelerating AI adoption, rapid demographic change and an uncertain global economic outlook, pressure on la
Esentia Announces Successful Pricing of 6.125% Senior Notes Due 2033 and 6.500% Senior Notes Due 20388.5.2026 03:24:00 CEST | Press release
Esentia Energy Development, S.A.B. de C.V. (“ESENTIA” or the “Company”), today announced the pricing of U.S.$1,000,000,000.00 aggregate principal amount of its 6.125% Senior Notes due 2033 (the “2033 Notes”) and U.S$1,000,000,000.00 aggregate principal amount of its 6.500% Senior Notes due 2038 (the “2038 Notes” and, together with the 2033 Notes, the “Notes”) to be issued by the Company in a private offering to qualified institutional buyers in accordance with Rule 144A under the Securities Act of 1933, as amended (the “Securities Act”), and outside the United States to non-U.S. persons in accordance with Regulation S under the Securities Act. The 2033 Notes will be issued at a price of 99.517%, and the 2038 Notes will be issued at a price of 98.444%. The 2033 Notes mature on July 30, 2033, and the 2038 Notes mature on July 30, 2038, and will be fully and unconditionally guaranteed by certain of the Company's subsidiaries. The settlement of the Notes is expected to take place on May 14
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.
Visit our pressroom