MA-VERACODE
29.5.2024 14:31:31 CEST | Business Wire | Press release
Veracode, a global leader in application risk management, today released research revealing applications developed by public sector organizations have more security debt than those created by the private sector. Security debt, defined for this report as flaws that remain unfixed for longer than a year, exists in 59 percent of applications in the public sector, compared to the overall rate of 42 percent. The research analyzed public sector organizations in more than 25 countries across the globe.
This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20240529282258/en/
Figure 2: Security Debt in Public Sector Applications (Graphic: Business Wire)
“Decades of accumulated security debt in unpatched software and poor security configurations, are in the applications that serve our government,” said Chris Eng, Chief Research Officer at Veracode. “Without a systematic and continuous approach to finding and fixing security flaws, the public sector is left dangerously exposed to attacks from hackers.”
Federal government systems are increasingly under cyberattack, as malicious criminals target public sector organizations with more damaging and disruptive techniques. In response, the federal government is enforcing a flurry of initiatives to strengthen cybersecurity, including efforts to reduce risk in the applications that serve the government. In March of 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) released the Secure Software Development Attestation Form to hold providers to the federal government accountable for insecure software.
Veracode researchers found that while slightly fewer public sector organizations (68 percent) have security debt than other industries (71 percent), they tend to accumulate more of it. Only three percent of applications are flaw-free, compared to six percent across other industries. Even more concerning, 40 percent of public sector entities have persistent, high-severity flaws that constitute ‘critical’ security debt, which would put the confidentiality, integrity, and availability of businesses at serious risk if exploited.
“The good news is that most organizations have the capacity to remediate all critical debt, but risk prioritization is key,” said Eng. “Two-thirds of all flaws in public sector organizations are either less than one year old or are not critical in severity. In addition, less than one percent of all flaws constitute critical security debt. By prioritizing that security debt with focused effort, organizations can achieve maximum risk reduction and then move to address non-critical flaws based on their risk tolerance and capabilities.”
According to the report, security debt in the public sector primarily affects first-party code (93 percent), but most of the critical security debt comes from third-party dependencies (55.5 percent). This reinforces the importance of the Open Source Security Software Initiative (OS3I), an inter-agency working group focused on ensuring open-source software is “as safe, secure and sustainable as it is open.” It also emphasizes the need for organizations to focus on both first- and third-party code to effectively reduce security debt.
The analysis further shows security debt in the public sector is primarily concentrated in older, larger applications (22 percent). This is especially true for critical security debt (30 percent), confirming a correlation between application age and the accumulation of security debt. Researchers also compared the security debt profile for different development languages and found that Java and .NET applications stand out as significant sources of debt in the public sector.
“The current state of software security in the public sector reinforces the importance of making secure by design a standard approach for the whole network connected world,” closed Eng. “We applaud CISA’s recent announcement of its Secure by Design Pledge and are proud to be one of the inaugural signatories. Our goal with this research is to further support our government and industry partners in promoting widespread adoption of these principles.”
The full State of Software Security Public Sector 2024 report is available to download on the Veracode website.
About the State of Software Security Report
The Veracode State of Software Security 2024 report analyzed data from large and small companies, commercial software suppliers, software outsourcers, and open-source projects. The research draws from more than a million (1,007,133) applications across all scan types, 1,553,022 dynamic analysis scans, and 11,429,365 static analysis scans. All those scans produced 96 million raw static findings, 4 million raw dynamic findings, and 12.2 million raw software composition analysis findings.
About Veracode
Veracode is a global leader in Application Risk Management for the AI era. Powered by trillions of lines of code scans and a proprietary AI-assisted remediation engine, the Veracode platform is trusted by organizations worldwide to build and maintain secure software from code creation to cloud deployment. Thousands of the world’s leading development and security teams use Veracode every second of every day to get accurate, actionable visibility of exploitable risk, achieve real-time vulnerability remediation, and reduce their security debt at scale. Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, and Penetration Testing.
Learn more at www.veracode.com, on the Veracode blog, and on LinkedIn and X.
Copyright © 2024 Veracode, Inc. All rights reserved. Veracode is a registered trademark of Veracode, Inc. in the United States and may be registered in certain other jurisdictions. All other product names, brands or logos belong to their respective holders. All other trademarks cited herein are property of their respective owners.
To view this piece of content from cts.businesswire.com, please give your consent at the top of this page.
View source version on businesswire.com: https://www.businesswire.com/news/home/20240529282258/en/
About Business Wire
Subscribe to releases from Business Wire
Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.
Latest releases from Business Wire
Andersen Global etablerer nyt medlemsvirksomhed i Frankrig9.9.2026 23:00:00 CEST | Pressemeddelelse
Andersen Global styrker sin tilstedeværelse i Frankrig med tilføjelsen af Andersen Société d'Avocats (Andersen in France), en medlemsvirksomhed baseret i Paris, der tilbyder integrerede juridiske ydelser til klienter i Frankrig og internationalt. Andersen in France tilbyder strategiske juridiske løsninger inden for selskabsskat, international skat, transfer pricing, moms og skatteprocesser og bistår klienter over hele verden. Under ledelse af de administrerende partnere Benoît Dambre og François Morazin håndterer det tværfaglige team også specialiserede områder som byplanlægning, fast ejendom, intellektuel ejendomsret og privatlivsbeskyttelse, bæredygtighed og ESG, EU-ret og sanktioner samt andre komplekse juridiske problemstillinger. "Vi ser juridisk rådgivning som mere end blot at håndtere umiddelbare udfordringer – det bør hjælpe klienter med at træffe kvalificerede beslutninger og opsøge muligheder med selvtillid," udtalte Benoît. "At blive en del af Andersen Global giver os muligh
Cyclic Materials Opens America’s First Commercial-Scale Facility Delivering Automated Rare Earth Magnet Recovery9.9.2026 22:09:00 CEST | Press release
The Mesa, Arizona facility deploys Cyclic Materials’ proprietary technology to process up to 25,000 metric tons of magnet-bearing products annually, creating a new domestic source of rare earth elements and copper, aluminum and steel for direct reintegration into U.S. manufacturing Cyclic Materials announced today the opening of its first commercial-scale rare earth magnet recycling facility in Mesa, Arizona, marking a major milestone in building domestic supply of rare earths and critical minerals. With an annual processing capacity of up to 25,000 metric tons of magnet-bearing end-of-life products, the facility produces Cyclic’s rare earth magnet material, Mag-Xtract™, and critical minerals such as copper and aluminum, and steel. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260909142592/en/ Leaders gather to mark the opening of Cyclic Materials’ new facility in Mesa, Arizona. From left to right: Herbert Flores, Arizona C
Belkin Introduces Titan SmartShield Pro Collection for the New iPhone 18 Pro Lineup9.9.2026 21:00:00 CEST | Press release
New collection combines advanced Nano-Titan protection with options for crystal-clear viewing, enhanced screen privacy and blue-to-red light conversion Belkin, a leading consumer electronics brand for over 40 years, today introduced its new Titan SmartShield Pro collection, designed to protect and enhance the experience of the new iPhone 18 Pro lineup. The collection includes three distinct screen protectors – clear, Blue-to-Red and Bright Privacy – each combining advanced Nano-Titan Technology with premium anti-reflective properties, exceptional scratch resistance and up to 9 feet of impact protection.* This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260909094720/en/ Belkin Titan SmartShield Pro Blue-to-Red Light screen protector As smartphones become increasingly central to how people work, travel and connect, the Titan SmartShield Pro collection goes beyond traditional screen protection to address the different ways consum
PPAI Releases Landmark Study Showing Branded Merchandise Supports a $472 Billion Global Economic Footprint9.9.2026 19:24:00 CEST | Press release
First-of-its-kind Oxford Economics study reveals annual spending, jobs and tax contributions Branded merchandise connects brands and people every day, but its impact extends well beyond the products consumers wear, use, receive or purchase. A landmark study commissioned by Promotional Products Association International (PPAI) provides the first comprehensive look at the global economic ecosystem behind branded merchandise. Conducted by independent global advisory firm Oxford Economics, the Branded Merchandise Global Market Report measures the industry end to end, from manufacturing and decoration to distribution, retail, e-commerce, fulfillment, marketing and brand activation. Key findings: $338.3 billion was spent on branded merchandise globally in 2025. The industry supported $472.3 billion in global GDP. Branded merchandise supported 11.9 million jobs worldwide. The sector supported $141.3 billion in global tax revenues – roughly the same as the entire Swiss federal budget. “For yea
Vindral Named Recipient of 2026 Technology & Engineering Emmy® Award9.9.2026 18:38:00 CEST | Press release
Swedish real-time video company recognised alongside the world's leading media companies for frame-accurate remote production technology Vindral, the Swedish company building future-ready technology for real-time audio and video, has been named a recipient of a 2026 Technology & Engineering Emmy® Award by the National Academy of Television Arts & Sciences (NATAS). Vindral is recognised in the category Web-Based Frame-Accurate Remote Monitoring Systems for Distributed Broadcast Production. The co-recipients in the category are SipRadius, NBCUniversal, Grass Valley, CBS Sports, Disney, Game Creek and Amazon. The awards will be presented on October 14 at the Television Academy's Saban Media Center in North Hollywood, California, where Vindral will be represented by CEO Daniel Alinder and Ian Jefferson. The Technology & Engineering Emmy® Award is one of the U.S. television industry's most prestigious recognitions of technical achievement, previously awarded to companies including Apple, So
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.
Visit our pressroom