MA-VERACODE
8.12.2022 13:51:40 CET | Business Wire | Press release
Veracode, a leading global provider of modern application security testing solutions, today revealed that 24 percent of applications in the technology sector contain security flaws that are considered high risk—meaning they would cause a critical issue for the application if exploited. With, arguably, a higher proportion of applications to contend with than other industries, tech firms would benefit from implementing improved secure coding training and practices for their development teams.
Chief Research Officer at Veracode, Chris Eng, said, “Giving developers real, hands-on experience of what it takes to spot and exploit a flaw in code—and its potential impact on the application—provides the context and understanding to build their intuition about software security. Our research found that organizations whose developers had completed just one lesson in our hands-on Security Labs training program fixed 50 percent of flaws two months faster than those without such training.”
The data was published in Veracode’s annual State of Software Security (SoSS) report v12, which analyzed 20 million scans across half a million applications in the technology, retail, manufacturing, healthcare, financial services, and government sectors. Overall, the technology industry was revealed to have the second-highest proportion of applications that contain security flaws, at 79 percent, making it marginally better than the public sector at 82 percent. The tech sector lands in the middle of the pack when it comes to the proportion of flaws that are fixed.
Tech Firms Are Comparatively Quick to Fix Software Security Flaws
Encouragingly, when tech firms do discover flaws in their applications, they are comparatively fast to reach the halfway point of remediation. In fact, the sector boasts industry-leading fix times for flaws discovered by static analysis security testing (SAST) and software composition analysis (SCA). While this is a laudable accomplishment, the industry still takes up to 363 days to fix 50 percent of flaws, suggesting there is still ample room for improvement.
Eng added, “Log4j sparked a wake-up call for many organizations last December. This was followed by government action in the form of guidance from the Office of Management and Budget (OMB) and the European Cyber Resilience Act, both of which have a supply chain focus. To improve performance in the year ahead, technology businesses should not only consider strategies that help developers reduce the rate of flaws introduced into code, but also put greater emphasis on automating security testing in the Continuous Integration/Continuous Delivery (CI/CD) pipeline to increase efficiencies.”
Server configuration, insecure dependencies, and information leakage are the most common types of flaws discovered by dynamic analysis of technology applications, which broadly follows a similar pattern to other industries. Conversely, the sector exhibits the highest disparity from the industry average for cryptographic issues and information leakage, perhaps indicating that developers in the tech industry are more savvy on data protection challenges.
The Veracode State of Software Security v12 technology snapshot is available to download here and the full report is available here.
About the State of Software Security Report
The Veracode State of Software Security (SoSS) v12 analyzed the full historical data from Veracode services and customers. This accounts for a total of more than half a million applications (592,720) that used all scan types, more than a million dynamic analysis scans (1,034,855), more than five million static analysis scans (5,137,882) and more than 18 million software composition analysis scans (18,473,203). All those scans produced 42 million raw static findings, 3.5 million raw dynamic findings, and six million raw SCA findings.
The data represents large and small companies, commercial software suppliers, software outsourcers, and open-source projects. In most analyses, an application was counted only once, even if it was submitted multiple times as vulnerabilities were remediated, and new versions uploaded.
About Veracode
Veracode is a leading AppSec partner for creating secure software, reducing the risk of security breach, and increasing security and development teams’ productivity. As a result, companies using Veracode can move their business, and the world, forward. With its combination of process automation, integrations, speed, and responsiveness, Veracode helps companies get accurate and reliable results to focus their efforts on fixing, not just finding, potential vulnerabilities. Learn more at www.veracode.com, on the Veracode blog, on LinkedIn, and on Twitter.
Copyright © 2022 Veracode, Inc. All rights reserved. Veracode is a registered trademark of Veracode, Inc. in the United States and may be registered in certain other jurisdictions. All other product names, brands or logos belong to their respective holders. All other trademarks cited herein are property of their respective owners.
To view this piece of content from cts.businesswire.com, please give your consent at the top of this page.
View source version on businesswire.com: https://www.businesswire.com/news/home/20221208005101/en/
About Business Wire
Subscribe to releases from Business Wire
Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.
Latest releases from Business Wire
Andersen offentliggør regnskab for fjerde kvartal og helåret 202510.3.2026 19:52:00 CET | Pressemeddelelse
Andersen Group Inc. (NYSE: ANDG) ("Andersen"), en førende udbyder af uafhængig rådgivning inden for skat, vurdering og finans til private kunder og familiekontorer, virksomheder og fonde i USA, vil offentliggøre sine finansielle resultater for hele året og fjerde kvartal 2025 efter børslukketid tirsdag den 17. marts 2026. Andersens administrerende direktør og bestyrelsesformand, Mark L. Vorsatz, og Andersens økonomidirektør, Neal Livingston, vil afholde en telekonference for at fremlægge Andersens økonomiske resultater tirsdag den 17. marts 2026 kl. 17.00 ET. Deltagere kan følge webcasten på https://event.choruscall.com/mediaframe/webcast.html?webcastid=J3Hvslre. Et link til optagelsen af webcasten vil kunne findes på Andersens Investor Relations-webside på investor.andersen.com inden for et par timer efter begivenheden og vil være tilgængeligt på websiden i seks måneder. Om Andersen Andersen er en førende udbyder af uafhængig rådgivning inden for skat, vurdering og finans til private
Xtep-Sponsored Chinese Teenage Dancer Claims World Championship at Juste Debout Street Dance World Finals10.3.2026 19:46:00 CET | Press release
Xtep, a well-known sportswear brand from China, proudly announced that Xtep-sponsored Chinese teenage dancers delivered an electrifying performance at the Juste Debout Street Dance World Finals in Paris on Sunday, March 8, 2026, claiming top honors and showcasing a unique fusion of traditional Chinese culture with modern street dance. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260310519224/en/ Chinese Teens Dance to Glory at Juste Debout World Finals Li Yongqiu, a 14-year-old from Southwestern China’s Chongqing Municipality, made history by winning the Global Championship in the Junior Dance Tour, becoming the third Chinese dancer to achieve this feat. His explosive power and technical mastery, honed through years of training that integrates Kungfu elements, captivated judges and audiences alike. The Chinese contingent's success didn't stop there. Zhang Xinlan and Zhang Chuyi secured a Top 8 finish in the Popping Adult D
ATLAS Infrastructure Invests in H2O America, Backs Long-Term Growth Strategy10.3.2026 18:29:00 CET | Press release
ATLAS anchors H2O America’s equity raise and establishes new substantial shareholdingUpsized transaction highlights strong market support for H2O’s long-term strategy and sector leading growth outlookH2O’s organic growth fully equity funded into 20281 ATLAS Infrastructure (“ATLAS”) is a specialist Global Listed Infrastructure investor managing funds on behalf of long-term infrastructure clients. Following the recent equity placement, ATLAS’s actively managed accounts hold ~10.8% voting and economic interest in H2O America (“H2O”). ATLAS was pleased to support H2Os long‑term strategy to invest in local water and wastewater utility operations through our participation in the recent equity raise. ATLAS recognises the disciplined approach from H2O management which focuses on organic investment in existing businesses alongside targeted and accretive transactions such as the acquisition of Quadvest which materially expands H2O’s regulated water footprint in a premium high‑growth jurisdiction
TIXiMED Announces Promising Preclinical Data: Oral TIX100 Prevents Weight Regain After GLP-1 Cessation in Obesity Model10.3.2026 18:22:00 CET | Press release
TIX100 prevented weight regain in mice after semaglutide discontinuation Supports potential role as oral weight maintenance therapy following GLP-1 Receptor Agonist (GLP-1) treatment, addressing a major challenge in long-term obesity management TIXiMED, Inc., a clinical-stage pharmaceutical company developing a novel oral therapy targeting thioredoxin-interacting protein (TXNIP) for diabetes and metabolic disorders, is pleased to highlight new research by investigators at the University of Alabama at Birmingham (UAB) Comprehensive Diabetes Center. The study demonstrates that its oral compound, TIX100, effectively prevents weight rebound following discontinuation of GLP-1 treatment in a mouse model of diet-induced obesity. In the study, mice treated with semaglutide experienced significant weight loss of over 13% body weight during a 2-week treatment period while continuing a high-fat diet. Upon discontinuation of semaglutide, untreated mice rapidly regained 14% of their body weight, mi
Svante and Integrated Packaging Company Advance U.S. Biogenic CDR Project to Feasibility10.3.2026 14:57:00 CET | Press release
The bioenergy with carbon capture (BECCS) project aims to remove more than 500,000 tonnes per year of biogenic CO2 emissions from a U.S. paper mill’s recovery boiler Svante Development Inc. is co-investing to advance the project The project will generate high-quality carbon dioxide removal (CDR) credits to market to Voluntary Carbon Market (VCM) buyers. Svante Technologies Inc. (“Svante”) announced today that its bioenergy with carbon capture and storage (BECCS) project at a paper mill in the Southeast U.S. has progressed to the feasibility study phase. The project is being developed in partnership with an integrated sustainable packaging company, following an extensive screening and pre-feasibility study conducted across several of the partner’s mills. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260310319382/en/ During the feasibility study phase, the companies will complete further engineering and design activities, cos
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.
Visit our pressroom