Benchmarking AppSec Across Industries
summary
Veracode’s cloud scans cover 200,000 application assessments over 18 months and report nearly 10 million detected flaws with 7 million fixes verified, leaving about 3 million unfixed. Industry pass rates against the OWASP Top 10 sit around 58% (financial) to 76% (government) failing on first submission, manufacturing remediates 81% while government remediates 27%. SQL injection and XSS remain common (~30–60%), mobile apps show improper SSL validation ~50%, readouts cut flaw density ~42% vs ~17%, and e‑learning and static analysis correlate with higher remediation.
AI-written summary · about
chapters (17)
- 0:00Start
- 1:34The Computer Security Technology Planning Study
- 2:51State of Software Security 2016
- 3:20The State of Software Security
- 5:28Selection Bias
- 8:11Attribution Bias
- 11:27Flaw Density
- 19:04Conclusion
- 19:56Sequel Injection
- 23:07Breakdown of Crypto Flaws in Mobile
- 23:30Improper Validation of Ssl Certificates
- 25:04Remediation Profiles
- 26:59Why Would Manufacturing Be So Much Better
- 28:17Impact of Remediation Coaching
- 30:14The Impact of E-Learning on Remediation Rates
- 31:34Fixed Rate by Analysis Type
- 37:08Just Remember To Measure
related talks
40mNurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps
52mMobile Application Assessments By The Numbers: A Whole-istic View
13mIntelligence in AppSec: Use AI to supercharge DevSecOps
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
53m8 Million Findings in One Year: Fresh Look at the State of Software Security
52mApplication Security at DevOps Speed and portfolio scale
38mAppSec is Dead Long Live DevSecOps!
30mAppSec Timeline: Wins, Failures, Promises, and Predictions