CyCognito, the leading External Attack Surface Management platform,released its semi-annual “State of External Exposure Management,” revealing a staggering number of vulnerable public cloud, mobile and web applications exposing sensitive data, including unsecured APIs and personal identifiable information (PII). Developed by CyCognito’s research division, the report is based on the analysis of 3.5 million assets across its enterprise customer base, including a number of Fortune 500 companies.
Recommended CIO Influence News: Liquidware Launches Liquidware Ready Program
“The latest MOVEit exploit is a cautionary tale for all CISOs that attackers remain many steps ahead of web application and cloud security,” said Rob Gurzeev, CEO and co-founder, CyCognito. “The volume of exposed PII stemming from this disastrous breach supports our findings and underscores the critical need for full-scope visibility of all assets across an organization’s attack surface. Businesses can no longer afford to neglect their digital shadow and the many unknown and unmanaged risks within their systems.”
Key findings include:
- 74 percent of assets with PII are vulnerable to at least one known major exploit, and one in 10 have at least one easily exploitable issue.
- 70 percent of web applications have severe security gaps, like lacking WAF protection or an encrypted connection like HTTPS, while 25 percent of all web applications (web apps) lacked both.
- The typical global enterprise has over 12 thousand web apps, which include APIs, SaaS applications, servers, and databases, among others. At least 30 percent of these web apps—over 3,000 assets—have at least one exploitable or high risk vulnerability. Half of these potentially vulnerable web apps are hosted in the cloud.
- 98 percent of web apps are potentially GDPR non-compliant due to lack of opportunity for users to opt out of cookies.
Recommended CIO Blog: The State of Upskilling: Tackling the IT Skills Gap
Gurzeev continued, “The size of a company’s attack surface fluctuates up and down by as much as 10 percent a month, making it a moving target rife with security gaps ready to be exploited. “Our latest research is not only a wake-up call that no business is immune to risk; it’s also clear proof that unknown and undiscovered assets present a major threat to an organization.”
Top Insights for CIOs: How to Choose a Third-Party Vendor?
[To share your insights with us, please write to sghosh@martechseries.com]
