Streamlining of responsible vulnerability disclosure grew by more than 40%.

Web applications are the most attacked service type at 61%, up from 41% in 2024; remote management protocols account for 15%.

89% of organizations believe that cloud and application security must be fully integrated with the SOC.

Organizations classified as 'Exceptional' in AppSec maturity are 1.9 times less likely to experience a data breach than Emerging programs.

Organizations classified as 'Exceptional' in AppSec maturity are 3.6 times more likely to report a 20% or greater improvement in application availability compared to the average.

Organizations classified as 'Exceptional' in AppSec maturity are 3.7 times more likely than 'Emerging' programs to reduce negative user experiences by more than 20%.

Organizations classified as 'Exceptional' in AppSec maturity are 3.6 times more likely to achieve a 20% or greater improvement in developer productivity compared to those in the 'Evolving' category.

66% of retailers plan to invest significantly in application security to prepare for evolving threats.

43% of respondents surveyed need significant skill improvement in application security.

47% of respondents surveyed have expert-level skill in application security.

96% of respondents indicated that Application security requires significant or moderate improvement.

62% of security professionals fear being fired following a breach.

36% of companies spend more on network security than AppSec.

58% of security teams report frequent false positives from application security scanners.

Only 36% of organizations involve security at the planning stage of software development.

Application-layer attacks account for 43% of breaches.

83% of organizations are considering outsourcing AppSec functions.

17% of security professionals believe termination is likely after a breach.

57% of organizations wait until just before deployment to involve security.

62% of organizations knowingly release insecure code to meet delivery deadlines.