Tel Aviv, May 17, 2023 - Backslash Security, the new cloud-native application security solution for enterprise AppSec teams, today released a new research study, Breaking the Catch-up Cycle: The New Cloud-Native AppSec Paradigm Survey Report, exploring how the state of application security has evolved given the rise of cloud-native application development. The study examines the practices, tools and needs of CISOs, AppSec managers and AppSec engineers at enterprise organizations of 1,000 or more employees with mature cloud-native app development environments.
The study reveals that AppSec teams are stuck in a catch-up cycle, unable to keep up with the increasingly rapid, agile dev pace, and playing security defense via an endless and unproductive vulnerability chase. Notably, 58% of respondents report spending over 50% of their time chasing vulnerabilities, with a shocking 89% spending at least 25% of their time in this defensive mode. Far and wide, enterprises are victims of this costly ‘defensive tax:’ the cost of employing AppSec engineers who chase vulnerabilities rather than drive a comprehensive cloud-native AppSec program is estimated to be upwards of $1.2 million annually.
Given the accelerated pace of digital innovation across enterprises of all sizes and the blurred lines between AppSec and CloudSec, enterprise AppSec teams are saddled with solutions that have not caught up to the cloud pace. As a result, AppSec professionals are losing faith in the prevailing AppSec tools:
The report emphasizes the urgent need for a new AppSec paradigm that maps a clear path to a modern standard for cloud-native AppSec success, characterized by end-to-end visualization of all microservices, automatic identification and prioritization of real risks, and intelligent triaging and remediation. In assessing the importance of these three key tenets of modern AppSec:
However, the AppSec industry suffers from a massive cloud-native enablement gap. Across all of the most critical capabilities, respondents reported that enablement is sorely lacking:
“What we’re hearing across the board is a message of urgency – we’ve entered a new, cloud-native reality, and it’s time to put an end to the AppSec catch-up game,” said Shahar Man, co-founder and CEO of Backslash. “These outdated AppSec methodologies hamper productivity, innovation and talent retention for both AppSec and dev teams. The cloud-native application development paradigm calls for a new, unified approach to application security that will make the friction between development and AppSec teams a thing of the past, enable enterprises to retain valuable talent, and accelerate innovation and growth.”
This report surveyed 300 security professionals specifically tasked with application security for their organization, equally split between CISOs, AppSec managers and AppSec engineers from U.S. companies with 1,000 or more employees. Companies represent a wide range of industries.