11% of security teams say application security false positives happen constantly.

66% of security services providers primarily use a GRC or compliance automation platform.

Nearly 90% of organizations allocate just 11–20% of their security budgets to application security.

Only 36% of organizations involve security at the planning stage of software development.

36% of companies spend more on network security than AppSec.

Rapidly expanding attack surfaces are cited by 38% of cybersecurity and cyber risk leaders as a reason for increased difficulty in managing cyber risk today vs five years ago.

83% of organizations are considering outsourcing AppSec functions.

Just 28% of organisations say they are "very effective" at communicating cyber risk to leadership.

31% of security services providers report an average or lower ability to differentiate.

Just 1% of organizations invest more than 20% of their total security budget into AppSec.

Spreadsheet usage among security services providers is up 50% year over year (as a secondary tool).

Cybersecurity and cyber risk leaders at organizations without full threat visibility have a burnout rate of 63%.

62% of organizations knowingly release insecure code to meet delivery deadlines.

The Dragon RaaS emerged in 2024.

57% of organizations wait until just before deployment to involve security.

Organisations with strong asset visibility are 2.5 times more likely to communicate cyber risk effectively to the board

60% of organizations say security issues are more likely to delay product launches than feature bugs.

8 in 10 AppSec professionals are open to outside help.

Nearly all organisations (99%) assess vendor risk.

87% of security providers now offer compliance services.