Development practices are undergoing a fundamental shift toward speed, modularity, and automation. SOSS Volume 12 examines how these trends—specifically the rise of microservices and cloud-native technologies—are reshaping the security landscape. By looking back nearly 16 years to the first applications scanned on the Veracode platform, this report provides the industry’s most detailed view of the…
How can an organization most efficiently reduce its attack surface? This eighth volume takes a predictive turn, creating a simulation model to minimize exploitability subject to real-world remediation capacity constraints. We explore whether it is more effective to increase the number of patches deployed or to radically change the way vulnerabilities are prioritized in the…
The original Security Outcomes Study identified 25 best practices, but five stood out as the “Fab Five” drivers of success across every measured outcome. Volume 2 digs deeper into “why” these practices work and “how” organizations should implement them to maximize their effectiveness. Based on a double-blind survey of over 5,100 professionals, this research extractsalient…
In today’s interconnected world, security exposures at a single organization rarely stay contained; they create a ripple effect across hundreds of downstream firms. This second edition of the Ripples report analyzes multi-party breach incidents involving three or more interrelated companies to understand how these waves of impact spread across the business value stream. By tracking…
Third-party software is the foundation of nearly all modern applications, but it is a foundation built on shifting sands. This special edition of SOSS plumbs the life and times of open-source libraries to understand how developers manage—or more often, ignore—their external dependencies. By combining survey data from 1,800 developers with technical scan data, we unmask…
Application security is often a fragmented picture, with different defenders seeing different parts of the “elephant.” This multi-source analysis stitches together findings from the Cyentia Research Library, Verizon DBIR, and IRIS Xtreme to provide a unified view of the frequency and role of application exploits in real-world incidents. We examine successful attacks that resulted in…
Lucky number seven in the series seeks to resolve one of the industry’s oldest and most divisive debates: does the public release of exploit code before a patch helps or harm defenders?. By formally testing three hypotheses with hard evidence, the report moves past speculation to reach well-justified conclusions. We analyze 6 billion vulnerabilities to…
Human risk factors are pervasive, yet the “insider threat” archetype often overlooks the humdrum daily decisions that actually drive the majority of data breaches. By analyzing 4.5 million unique actions from 114,000 users, this report establishes that human risk played a role in 88% of the total losses from the largest cyber incidents of the…
Third-party risk management (TPRM) requires triaging a massive number of vendors with imperfect information, leading to costly bad decisions. This research explores the “Expected Value of Perfect Information” by testing four decision scenarios to see which data points—firmographic or technical—provide a reliable signal of an organization’s actual cyber risk posture. We move from simple industry…
The cybersecurity industry has a bad habit of assuming bigger means better, but good things often come in small packages. This supplemental report focuses on the experiences of over 850 IT and security professionals from small and midsize businesses (SMBs). It challenges the notion that limited resources prevent successful outcomes, proving instead that SMBs can…