400,000
scans analyzed for the report
SOSS Page - Industry Analysis 1 - Persona Set
Infrastructure
Government
Financial Services
Healthcare
Industry Analysis: Infrastructure
Energy, utilities, and transportation represent some of the most critical industries, keeping the lights on and the economy moving. But less than a third of applications in infrastructure passed OWASP policy on first scan.
Industry Analysis: Government
Applications developed by government organizations are the least secure of all industry groupings, measured by pass rate against OWASP Top 10 policy. Government applications also had the highest flaw prevalence of any industry group for cross-site scripting, SQL injection, credentials management, and cryptographic issues.
Industry Analysis: Financial Services
Financial services organizations showed signs of having some of the most mature application security programs. More than a third of applications were scanned at least monthly (12 times per year on average).
Industry Analysis: Healthcare
Healthcare organizations hold some of the most sensitive personal data, so it’s encouraging to see this industry made strides in improving application security in 2017.
SOSS Page - Industry Analysis 2 - Persona Set
Manufacturing
Retail & Hospitality
Technology
Industry Analysis: Manufacturing
Manufacturing and aerospace organizations had the highest OWASP pass rate on latest scan (30.5%) of any of our industry groupings. This could indicate that companies in this sector have application security programs that are more mature than other industries. This industry sector also had the lowest proportion of applications undergoing their first assessment (about 39%).
Industry Analysis: Retail & Hospitality
Retail and hospitality organizations ranked second in the rate of improvement in OWASP pass rate compared to 2016, seeing a 9% improvement. This is a positive indicator of maturing AppSec programs in an industry that has been plagued by data breaches in recent years.
Industry Analysis: Technology
A large proportion of tech companies exhibited DevOps behavior, with 2% of applications tested at least daily. Technology organizations had dramatically lower prevalence of major vulnerabilities such as cross-site scripting (8.6%), SQL injection (6.6%), cryptographic issues (16%), and credentials management (10.6%).
