Web Application Security: Industry Report on Threats, Adoption and Operating Choices

Summary

Web application and API security is a fast-moving technology market in which the available evidence points to rising attack activity and low organizational confidence. A global survey of 871 cybersecurity and IT professionals reports confidence in application security posture at 29 percent, falling to 15 percent for AI-integrated applications ¹. Vendor telemetry reports API exploitation up 181 percent year over year ⁴. In the latest Verizon breach report, basic web application attacks accounted for 10 percent of breach patterns, down from 18 percent in the prior report ⁷. A secondary summary of the same Verizon research reports stolen credentials in 88 percent of those breaches ⁸. Most operational evidence comes from vendors that are not independently audited. The main risks are tool sprawl, incomplete application inventories and API blind spots. The outlook favors consolidation and API-specific controls, but the pack contains no verified market size, cost or performance data.

Key findings

1. 1

   Confidence in application security posture is low, and lower for AI-integrated applications

   Only 29 percent of respondents report overall confidence in their application security posture, falling to 15 percent for AI-integrated applications. This is a vendor-sponsored survey, so the result reflects respondent perception rather than measured control performance.

   Confidence: Medium
2. 2

   Most organizations lack a complete application and API inventory

   Roughly one in eight organizations report high confidence that they know all applications and APIs in use. Unknown assets are a precondition for consistent protection, so this gap affects every protection approach.

   Confidence: Medium
3. 3

   Tool dissatisfaction is driving consolidation

   Only 5 percent of organizations report satisfaction with their current application security tools, while 62 percent are consolidating or plan to. Operational problems cited include inconsistent policy enforcement, duplicated controls and fragmented telemetry.

   Confidence: Medium
4. 4

   API exploitation is the fastest-growing reported threat, based on vendor telemetry

   Vendor telemetry from 1,400-plus protected applications reports API exploitation rising 181 percent year over year. The telemetry is not independently audited and sensor coverage differs by vendor, so the direction is more reliable than the magnitude.

   Confidence: Qualitative
5. 5

   Basic web application attacks fell as a share of breaches, but credentials remain central

   Basic web application attacks were 10 percent of breach patterns in the latest Verizon report, down from 18 percent. A secondary summary reports stolen credentials used in 88 percent of those breaches, a figure that is not confirmed in the primary report text available.

   Confidence: Medium

11. Industry definition and scope

This report covers web application and API security: products and services that protect web-facing applications, their interfaces and the data they expose to attack. The sources in the pack discuss web application firewalls, broader application and API protection, API security tools, bot management and vulnerability testing ¹⁴⁶. Geographic scope is global. The evidence comes from global surveys, vendor telemetry and breach research, and some of it is hosted by vendors.

The reporting period is the latest available data. Survey fieldwork took place in early in the latest period, and vendor telemetry compares the latest period with the one before ¹⁴. Comparisons across sources are limited because survey windows, dataset periods and counting methods differ.

Terminology varies. Verizon uses 'Basic Web Application Attacks' as a breach pattern category ⁷. Penetrify counts each vulnerability instance separately, so one application with five SQL injection points contributes five findings ¹¹. The OWASP Top 10 is a ranked list of risk categories rather than a count of incidents ⁹.

Scope was set by the sources in the pack. No source covering regional or national markets was included.

22. Market size, structure and value chain

The pack contains no independently verified market size, growth rate or revenue figure for web application security products or services. Market-research sizing was not retrieved. This report therefore does not estimate market value, and any market-size statement would be unsupported by the evidence available.

The vendors in the pack fall into distinct provider types. Fortinet, a platform vendor, sponsors survey research and reports consolidation trends among its respondents ¹². Akamai combines edge delivery with web application and API protection ⁶. Indusface operates AppTrana, a managed protection service ⁴. Imperva, part of Thales, publishes security analysis and OWASP-related data ¹⁰. Penetrify offers vulnerability scanning and reports its own dataset ¹¹.

Based on these sources, the value chain can be read as application development, then runtime protection (WAF, API protection and bot management), then testing and vulnerability management, then monitoring and response. This sequence is the writer's interpretation, not a published model. The pack does not disclose pricing, subscription models or contract structures, so revenue models cannot be compared.

Key stakeholders include application owners, security operations teams, IT operations, cloud and edge providers, and standards bodies such as the OWASP Foundation ⁹. Their roles in purchasing decisions are not covered in the pack.

No market-size estimate is made because no verified figure exists in the pack.

33. Customers, demand and adoption

Demand is shaped by perceived API risk and bot activity. Of surveyed respondents, 67 percent flagged APIs as the highest-risk application category, and 53 percent named APIs as the largest visibility blind spot ³. Credential stuffing was named the top bot-attack concern by 68 percent of respondents, up from 47 percent a year earlier ³.

Visibility is a core adoption barrier. Roughly one in eight organizations report high confidence that they know all applications and APIs in use ¹. More than half of surveyed organizations reported a web application or API breach in the past 12 months, although the pack does not give an exact percentage ³.

Dissatisfaction with current tooling is widespread. Only 5 percent of organizations report satisfaction with their current application security tools, and 62 percent are consolidating or plan to ². Reported operational issues include inconsistent policy enforcement, duplicated controls and fragmented telemetry ².

Purchasing criteria are not measured directly in the pack. The writer's interpretation is that buyers prioritize consistent policy enforcement, complete coverage across web and API assets, and integrated telemetry, because these are the problems respondents report ². This is an inference and should be tested against buyer research that is not in the pack.

• Organizations satisfied with current application security tools 5percent Observed Global, Early in the latest reporting period [2]
• Respondents flagging APIs as highest-risk application category 67percent Observed Global, Early in the latest reporting period [3]

Survey results come from vendor-sponsored or vendor-summarized research and are treated as perception data.

44. Competitive landscape and key players

The pack covers five provider types, and each carries a different interest in the findings it publishes. Fortinet emphasizes platform consolidation and AI readiness in its survey reports ¹². Akamai recommends pairing web application firewalls with dedicated API protection for conventional attacks and behavioral risks ⁶. Indusface reports telemetry from 10.54 billion blocked attacks across more than 1,400 AppTrana-protected applications in 11 industry verticals and 95 countries ⁴. Imperva explains the OWASP Top 10 using data from more than 2.8 million tested applications ¹⁰. Penetrify reports a dataset of 47,291 confirmed findings across 3,847 applications, but its geographic coverage is not stated ¹¹.

These figures are not directly comparable. Attack counts depend on sensor coverage, and vulnerability counts depend on how each vendor defines a finding. The Penetrify dataset is indicative only. The writer's reading is that the managed-service and platform models compete on consolidation and visibility, while testing services compete on coverage of discovered issues, but the pack does not include pricing, win rates or market shares to test this.

Market concentration cannot be assessed. The pack has no market-share data for WAF, WAAP or API security vendors. The pack also contains no independent comparison of open-source tools such as ModSecurity or the OWASP Core Rule Set against proprietary products, in either effectiveness or operating cost. This is a material gap for buyers weighing open-source and proprietary options.

Competitive pressure is visible in the consolidation trend, since 62 percent of organizations are consolidating or plan to ². Consolidation favors vendors that can cover both web and API assets, which is why Akamai's recommendation of layered protection matters ⁶. Whether consolidation improves outcomes is not shown by the evidence in the pack.

Provider comparisons rely on each vendor's self-description and telemetry. No neutral benchmark was available in the pack.

55. Technology, operations and workforce

The main protection technologies in the sources are web application firewalls, API-specific protection and bot management. Akamai's guidance pairs a web application firewall with dedicated API protection ⁶. Fortinet's survey indicates that inconsistent policy enforcement and duplicated controls are common operational problems ². The pack does not evaluate whether these tools reduce breaches or the time to fix flaws.

Remediation speed is a weak point in the telemetry. Indusface reports that 32 percent of critical vulnerabilities stayed open beyond 180 days ⁴. The same source reports zero-day detections rising 2.5 times year over year ⁴. These are vendor telemetry figures and do not measure defect rates across the market.

AI is changing the operating picture. Only 15 percent of respondents report confidence in the security of AI-integrated applications ¹. The pack describes AI-integrated applications as a growing exposure, but it does not quantify how much of the application estate they represent.

The pack provides no verified data on uptime, latency, throughput, false-positive rates, total cost of ownership or productivity for WAF or API security products. It also contains no verified skills-demand or workforce data for application security roles. These gaps mean the report cannot judge the operating cost or staffing needs of different approaches.

• Increase in API exploitation, year over year (vendor telemetry) 181percent Observed Global (95 countries, vendor-hosted telemetry), Latest period compared with prior period [4]
• Critical vulnerabilities open beyond 180 days (vendor telemetry) 32percent Observed Global (95 countries, vendor-hosted telemetry), Latest period compared with prior period [4]

Operating metrics are limited to what the vendor telemetry reports. Productivity and cost data are absent from the pack.

66. Regulation, standards, risk and sustainability

The pack contains no regulatory, legal or privacy sources. The jurisdictions that govern web application security are therefore not identified, and binding requirements, proposed rules and voluntary guidance are not separated or assessed. Readers in regulated sectors should consult the relevant authorities directly. This section does not provide legal advice.

The OWASP Top 10 is the main standard in the pack. It ranks Broken Access Control first, followed by Security Misconfiguration and Software Supply Chain Failures ⁹. The latest edition adds Mishandling of Exceptional Conditions as a new category and ranks Injection fifth ⁹. Imperva notes that Security Misconfiguration moved to second place and that Server-Side Request Forgery was folded into Broken Access Control ¹⁰. OWASP is a voluntary community standard, which is the writer's characterization.

Credentials are a central risk. A secondary summary of the Verizon report states that stolen credentials were used in 88 percent of basic web application attack breaches and were the most common initial access vector, used in 22 percent of breaches ⁸. The primary Verizon text available in the pack shows that servers are common targets in these patterns ⁷.

Privacy, ethics, environmental and social factors are not covered by any source in the pack. Operational risk is evident in the low confidence reported for AI-integrated applications ¹ and in the prevalence of unknown assets ¹. These risks cannot be quantified from the pack.

• Breaches in which stolen credentials were used (basic web application attacks) 88percent Observed Global, Dataset period of the latest Verizon report (secondary summa... [8]
• Basic web application attacks as share of breach patterns 10percent Observed Global, Dataset period of the latest Verizon report [7]

Standards are described from the OWASP and Imperva summaries. No regulatory analysis is included because no regulatory source is in the pack.

77. Challenges, opportunities and case examples

The main constraints are low visibility, tool fragmentation, credential-driven attacks and the growth of APIs as an exposure. The sources agree that APIs are a high-risk and poorly visible category ¹³. Respondents also report that controls are duplicated and telemetry is fragmented ².

The opportunities follow from these constraints. Complete inventories, consistent policy enforcement and API-specific protection are directly addressed by the consolidation and layered-protection approaches described in the pack ²⁶. Bot management is a priority because credential stuffing concern rose sharply ³.

Case example one: Akamai recommends combining a web application firewall with dedicated API protection, which reflects a layered architecture ⁶. Case example two: Indusface's AppTrana service reports blocking 10.54 billion attacks across more than 1,400 applications and 95 countries ⁴. Case example three: Fortinet's survey describes consolidation as a common response to tool dissatisfaction ².

These examples are vendor-reported. The pack contains no independent case studies with before-and-after outcomes, so the effect of these approaches on breaches or cost cannot be confirmed. Comparable independent examples were limited.

Case examples were limited to those in the pack. Independent outcome data was not available.

88. Outlook and strategic implications

In the near term, the evidence points to continued pressure on API and credential-based attack paths. Vendor telemetry reports strong growth in API exploitation and attacks on websites ⁴⁵⁶. The growth figures use different bases, so the direction is more reliable than the size of any single increase. This is the writer's interpretation.

In the medium term, consolidation is the most visible trend, with 62 percent of organizations consolidating or planning to ². Whether consolidation reduces incidents or cost is not shown by the pack. Low confidence in AI-integrated applications ¹ suggests that governance of new application types will remain a priority.

Practical implications follow for stakeholders. Application owners should build and maintain complete inventories of applications and APIs ¹. Security teams should check that policies are enforced consistently across tools ². Buyers should request independently verified performance, cost and uptime data, since the pack contains none. Researchers and regulators should fund independent measurement, because vendor telemetry is not comparable across providers.

No forecast is taken from the pack. All outlook statements are the writer's interpretation of observed figures.

99. Conclusion

Web application and API security faces rising attack activity, low confidence and fragmented tooling. The most defensible takeaways are that inventory gaps and API blind spots are widespread, and that credentials play a large role in breaches ¹³⁸. Market size, operating cost and independent performance data remain unavailable in the pack.

Conclusion is limited to findings that the pack supports.

How this was built

Sources

1. 1

   Web Application Security Report - The AI Readiness Gap

   Fortinet with Cybersecurity Insiders Vendor report

   cybersecurity-insiders.com
2. 2

   Web Application Security Report: Key insights

   Fortinet Vendor report

   fortinet.com
3. 3

   Web Application Security Report - survey highlights (Global IT Research)

   Global IT Research (summarizing Fortinet and Cybersecurity Insiders survey) Market research

   globalitresearch.com
4. 4

   State of Application Security

   Indusface Vendor report

   indusface.com
5. 5

   46 Vulnerability Statistics (citing Indusface report)

   Security Boulevard News report

   securityboulevard.com
6. 6

   Apps, APIs, and DDoS: The Industrialization of Cyberattack Campaigns

   Akamai Technologies Company report

   akamai.com
7. 7

   Data Breach Investigations Report

   Verizon Industry association

   verizon.com
8. 8

   Data Breach Investigations Report Executive Summary and associated coverage

   Verizon (via SpyCloud analysis) Market research

   spycloud.com
9. 9

   OWASP Top 10

   OWASP Foundation Standard

   owasp.org
10. 10

    OWASP Top 10 Vulnerabilities Explained

    Imperva (Thales) Vendor report

    imperva.com
11. 11

    Web Application Security Report (scan dataset)

    Penetrify Vendor report

    penetrify.cloud