Veracode Warns Enterprises that SOUP is a Recipe for Disaster

BURLINGTON, Mass. – January 22, 2013 - Veracode, Inc., the leader in cloud-based application security testing, warns enterprises that serving up Software of Unknown Pedigree, or S.O.U.P, can lead to some major indigestion for the organization, with side effects including customer data loss, gaps in defense against hackers, and even corporate intellectual property theft. With use of vendor supplied software growing exponentially, it's important for enterprises to not let SOUP go untested.

Despite the fact that enterprises are lapping up more SOUP than ever, 84 percent haven't tested any of their vendor supplied applications. If they did, they might be surprised to learn that 80 percent of customer support applications, 76 percent of security applications and 59 percent of financial applications fail to comply with enterprise security policies, leaving data vulnerable.

"The amount of risk these organizations are assuming by deploying untested SOUP is unsettling, but also unnecessary," said Chris Eng, vice president of research, Veracode. "Maintaining a healthy application security program can minimize risk and keep things running smoothly."

The good news is that enterprises are beginning to recognize and address these risks. In a new infographic, Veracode illustrates the recent trend in organizations saying no to SOUP and starting to test their vendor-supplied applications. A recent study by Veracode found 21 percent of financial services organizations tested its vendor-supplied software for flaws in the application code. Additionally, the software and IT services industry and the technology industry are upping their SOUP testing numbers, with 14 percent of each industry inspecting its outsourced software. Those enterprises with a programmatic approach to software testing have seen 52 percent of their applications achieve compliance.

Veracode recommends developing a programmatic approach to vendor software security testing and suggests making sure that above all, these security policies are communicated throughout the organization. Vendors should be held to the same security criteria as in-house developers to ensure the entire organization is approaching security with the same goal.

View the infographic on our blog: S.O.U.P. Infographic.