Legit Security Unveils Comprehensive Application Risk Insights
Legit Security, a leader in application security posture management (ASPM), has released a compelling research report that sheds light on application risks faced by organizations today. This insightful document is a must-read for security professionals seeking to understand the current landscape of application security.
Key Findings from the 2025 State of Application Risk Report
The report, dubbed The 2025 State of Application Risk, provides a comprehensive look at where vulnerabilities exist in both applications and the software factories that produce them. With data sourced from its advanced platform, Legit Security identified significant risks that may be lurking beneath the surface of software development processes.
Widespread Risk Across the Board
One of the most alarming findings is that 100% of surveyed organizations experienced high or critical risks in their development environments. This pervasive risk indicates a serious challenge within the application development lifecycle, which organizations must address immediately.
Duplication in Application Security Scanning
The report highlighted that application security scanning is particularly inefficient. A staggering 78% of organizations were found to be using duplicate Software Composition Analysis (SCA) scanners, while 39% utilized overlapping Static Application Security Testing (SAST) scanners. This redundancy can lead to the same vulnerabilities being reported multiple times, creating confusion and inefficiency in remediation efforts.
The Threat of Secrets Exposure
Secrets exposure remains a critical issue, with every organization surveyed indicating they have high or critical secrets leaking into their codebases. Notably, 36% of these secrets were discovered outside of the source code itself, which raises additional concerns regarding security measures in place.
Emerging Risks from AI Models
The report also brought attention to the emergence of GenAI as a troubling risk factor. Specifically, 46% of organizations admitted to using AI models in risky ways, which included low-reputation large language models (LLMs) capable of harboring malicious code or inadvertently leaking sensitive information.
Addressing Pipeline Misconfigurations
Misconfigured development pipelines are another significant risk factor, as 89% of organizations reported issues that could lead to serious breaches. This finding underscores the importance of strict configuration management to avoid vulnerabilities similar to those seen in high-profile supply chain attacks.
Developer Permissions and Risks
Moreover, the report showed a concerning trend of least-privilege violations among developers. In fact, 85% of organizational setups exhibited issues that could potentially facilitate severe attacks, similar to those experienced in recent high-profile security incidents.
Focus On Toxic Combinations
The research revealed toxic combinations of risks that need immediate attention. For instance, security teams should be aware when developers use GenAI without sufficient human oversight, or when secrets are held in repositories with external collaborators. These situations present compounded security challenges that must be prioritized.
Conclusion: Enhancing Security Awareness
Liav Caspi, CTO and co-founder of Legit Security, expressed concern over the findings, emphasizing the importance of visibility into development environments and CI/CD pipelines. He noted that neglecting these aspects invites the potential for future supply chain attacks.
The insights provided in this report are not just critical for understanding current risks; they offer guidance on the importance of maintaining secure practices across all aspects of software development. From managing GenAI to mitigating secrets exposure, organizations must enhance their security protocols to safeguard their development processes.
Frequently Asked Questions
What is the main focus of the 2025 State of Application Risk report?
The report focuses on identifying significant risks faced by organizations in their application development environments and providing guidance to improve security posture.
Why is application security scanning considered inefficient?
Application security scanning is deemed inefficient due to the prevalence of duplicate scanners used by organizations, resulting in redundant and sometimes contradictory reports.
How significant is the issue of secrets exposure?
Secrets exposure is a critical security concern, with every organization surveyed indicating high-level secrets in their code, underscoring a need for improved detection and management.
What role does GenAI play in application security risks?
GenAI poses emerging risks as many organizations leverage AI models in ways that might be unsafe, potentially introducing vulnerabilities into their applications.
How can organizations mitigate the identified risks?
Organizations can mitigate risks by implementing rigorous configuration management, conducting regular security audits, and ensuring proper oversight of AI usage and developer permissions.
