Applications -- particularly Web-based applications -- represent more than 75 percent of the new security vulnerabilities uncovered each year. As more business logic and sensitive data are exposed externally to enable mobility, cloud-based solutions, other business requirements and regulations, the risks to application security cannot be overstated.

Many organizations assume their applications are protected by security defenses such as firewalls, intrusion prevention, and vulnerability management solutions. These defenses are all part of a well-rounded security program, but Web applications present unique threats and challenges that require specific attention. Exploits such as SQL injection and cross-site scripting (XSS) are common in Web applications, and have been used in a number of significant data breaches in recent years. In addition, a number of lesser-known vulnerabilities and configuration problems are commonly uncovered in application assessments.