MA-VERACODE
29.5.2024 14:31:31 CEST | Business Wire | Press release
Veracode, a global leader in application risk management, today released research revealing applications developed by public sector organizations have more security debt than those created by the private sector. Security debt, defined for this report as flaws that remain unfixed for longer than a year, exists in 59 percent of applications in the public sector, compared to the overall rate of 42 percent. The research analyzed public sector organizations in more than 25 countries across the globe.
This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20240529282258/en/
Figure 2: Security Debt in Public Sector Applications (Graphic: Business Wire)
“Decades of accumulated security debt in unpatched software and poor security configurations, are in the applications that serve our government,” said Chris Eng, Chief Research Officer at Veracode. “Without a systematic and continuous approach to finding and fixing security flaws, the public sector is left dangerously exposed to attacks from hackers.”
Federal government systems are increasingly under cyberattack, as malicious criminals target public sector organizations with more damaging and disruptive techniques. In response, the federal government is enforcing a flurry of initiatives to strengthen cybersecurity, including efforts to reduce risk in the applications that serve the government. In March of 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) released the Secure Software Development Attestation Form to hold providers to the federal government accountable for insecure software.
Veracode researchers found that while slightly fewer public sector organizations (68 percent) have security debt than other industries (71 percent), they tend to accumulate more of it. Only three percent of applications are flaw-free, compared to six percent across other industries. Even more concerning, 40 percent of public sector entities have persistent, high-severity flaws that constitute ‘critical’ security debt, which would put the confidentiality, integrity, and availability of businesses at serious risk if exploited.
“The good news is that most organizations have the capacity to remediate all critical debt, but risk prioritization is key,” said Eng. “Two-thirds of all flaws in public sector organizations are either less than one year old or are not critical in severity. In addition, less than one percent of all flaws constitute critical security debt. By prioritizing that security debt with focused effort, organizations can achieve maximum risk reduction and then move to address non-critical flaws based on their risk tolerance and capabilities.”
According to the report, security debt in the public sector primarily affects first-party code (93 percent), but most of the critical security debt comes from third-party dependencies (55.5 percent). This reinforces the importance of the Open Source Security Software Initiative (OS3I), an inter-agency working group focused on ensuring open-source software is “as safe, secure and sustainable as it is open.” It also emphasizes the need for organizations to focus on both first- and third-party code to effectively reduce security debt.
The analysis further shows security debt in the public sector is primarily concentrated in older, larger applications (22 percent). This is especially true for critical security debt (30 percent), confirming a correlation between application age and the accumulation of security debt. Researchers also compared the security debt profile for different development languages and found that Java and .NET applications stand out as significant sources of debt in the public sector.
“The current state of software security in the public sector reinforces the importance of making secure by design a standard approach for the whole network connected world,” closed Eng. “We applaud CISA’s recent announcement of its Secure by Design Pledge and are proud to be one of the inaugural signatories. Our goal with this research is to further support our government and industry partners in promoting widespread adoption of these principles.”
The full State of Software Security Public Sector 2024 report is available to download on the Veracode website.
About the State of Software Security Report
The Veracode State of Software Security 2024 report analyzed data from large and small companies, commercial software suppliers, software outsourcers, and open-source projects. The research draws from more than a million (1,007,133) applications across all scan types, 1,553,022 dynamic analysis scans, and 11,429,365 static analysis scans. All those scans produced 96 million raw static findings, 4 million raw dynamic findings, and 12.2 million raw software composition analysis findings.
About Veracode
Veracode is a global leader in Application Risk Management for the AI era. Powered by trillions of lines of code scans and a proprietary AI-assisted remediation engine, the Veracode platform is trusted by organizations worldwide to build and maintain secure software from code creation to cloud deployment. Thousands of the world’s leading development and security teams use Veracode every second of every day to get accurate, actionable visibility of exploitable risk, achieve real-time vulnerability remediation, and reduce their security debt at scale. Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, and Penetration Testing.
Learn more at www.veracode.com, on the Veracode blog, and on LinkedIn and X.
Copyright © 2024 Veracode, Inc. All rights reserved. Veracode is a registered trademark of Veracode, Inc. in the United States and may be registered in certain other jurisdictions. All other product names, brands or logos belong to their respective holders. All other trademarks cited herein are property of their respective owners.
To view this piece of content from cts.businesswire.com, please give your consent at the top of this page.
View source version on businesswire.com: https://www.businesswire.com/news/home/20240529282258/en/
About Business Wire
Subscribe to releases from Business Wire
Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.
Latest releases from Business Wire
Bending Spoons S.p.A. announces closing of initial public offering2.7.2026 20:35:00 CEST | Press release
Bending Spoons S.p.A. (“Bending Spoons”), a leading technology company, today announces the closing of its initial public offering of an aggregate of 57,971,015 of its ordinary shares, at an initial public offering price of $29.00 per share. The offering consisted of 34,398,640 shares sold by Bending Spoons and 23,572,375 shares sold by certain selling shareholders (the “Selling Shareholders”). The gross proceeds from the offering to Bending Spoons, before deducting underwriting discounts and commissions and other offering expenses, was approximately $953,917,285.50. Bending Spoons did not receive any proceeds from the sale of shares by the Selling Shareholders. Bending Spoons’ ordinary shares began trading on the Nasdaq Global Select Market on July 1, 2026 under the ticker symbol “BSP”. Goldman Sachs International, J.P. Morgan, and Allen & Company LLC are acting as joint lead book-running managers for the offering. Wells Fargo Securities, BofA Securities, Jefferies, Evercore ISI, BNP
Strategic Partnership Between Record Asset Management and Admicasa2.7.2026 19:00:00 CEST | Press release
RAM Swiss Holding AG announces a strategic partnership with Admicasa Holding AG (Admicasa). RAM Swiss Holding AG is a subsidiary of LSE-listed Record Financial Group (Record) and part of the Record Asset Management (RAM) group of companies. The partnership is a milestone in the growth of Admicasa and marks an important step in the continued expansion of Record’s private markets platform. Subject to regulatory approval, the agreement, signed on 1st July 2026, provides RAM Swiss Holding AG with a 50% participation in the Admicasa Fondsleitung AG, part of Admicasa, and establishes a long-term partnership to develop investment opportunities in the Swiss and Global real estate market with a plan to expand into other asset classes in the medium term. RAM is the European asset management arm of Record, the LSE-listed specialist investment group managing USD 115 billion of assets on behalf of institutional clients worldwide. Record's client base comprises pension funds, foundations, sovereign
IQM Quantum Computers Becomes First European Quantum Computing Company Listed on a Major U.S. Exchange2.7.2026 16:47:00 CEST | Press release
IQM begins trading on Nasdaq Global Select Market under the ticker symbol “IQMX” Company enters next phase of growth as a publicly traded leader in full-stack superconducting quantum computing IQM maintains a strong pro forma cash position of EUR 337 million IQM Quantum Computers (Nasdaq: IQMX) (“IQM”, “IQM Quantum Computers” or the “Company”), a global leader in full-stack superconducting quantum computers, today became a publicly traded company following the completion of its business combination with Real Asset Acquisition Corp. (“RAAQ”). This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260702960460/en/ IQM Quantum Computers Becomes First European Quantum Computing Company Listed on a Major U.S. Exchange The company’s American Depositary Shares begin trading today on the Nasdaq Global Select Market under the ticker symbol “IQMX”. The listing marks a major milestone for IQM establishing the company as the first European quan
GigaDevice Launches First GD24CL Series I²C EEPROM, Further Expanding Its Non-Volatile Memory Portfolio2.7.2026 16:00:00 CEST | Press release
GigaDevice, a leading semiconductor company specializing in Flash memory, 32-bit microcontrollers (MCUs), sensors, and analog products, announced today the launch of its new GD24CL series I²C EEPROM. The series delivers outstanding performance, comprehensive security protection mechanisms, and excellent reliability that addresses the stringent requirements for stable and long-term storage of critical configuration data. These offered features will benefit applications in industrial, energy, Internet-of-Things (IoT), data centers, and networking. As GigaDevice’s first EEPROM product series, the launch further enhances the company’s non-volatile memory portfolio and provides customers with more dynamic storage solutions. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260702394554/en/ GigaDevice Launches First GD24CL Series I²C EEPROM, Further Expanding Its Non-Volatile Memory Portfolio. The GD24CL series is designed with high
Medical University of Graz Enrolls First Patient in DEEPER CHALLENGE Trial Evaluating Spur® Peripheral Retrievable Scaffold System in a Select CLTI Cohort2.7.2026 13:00:00 CEST | Press release
Reflow Medical, Inc. announces that the Medical University of Graz has enrolled the first patient in the DEEPER CHALLENGE clinical trial. This investigator-initiated, single-center, single-arm, prospective study, supported by a grant, investigates early vessel recoil following below-the-knee treatment using the Spur® Peripheral Retrievable Scaffold System in combination with a commercially available drug-coated balloon. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260701995624/en/ The study investigates early vessel recoil following below-the-knee treatment using the Spur® Peripheral Retrievable Scaffold System in combination with a commercially available drug-coated balloon. The study plans to enroll up to 40 patients with chronic limb-threatening ischemia (CLTI) across two distinct cohorts: patients with diabetes and patients with end-stage renal disease receiving hemodialysis for at least six months, with women comprisi
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.
Visit our pressroom