Security debt in EMEA escalates

Veracode’s research found 68 percent of EMEA organizations harbor some level of security debt, while 46 percent have high-severity persistent flaws in code, classified as ‘critical’ security debt. These high-severity flaws represent the greatest risk to applications and are a ticking time bomb with the potential for catastrophic breaches.

In a world where every interaction with an application can be a potential entry point for cyber attackers, understanding and managing security debt is more crucial than ever. Security debt, defined for this report as software flaws that remain unfixed for longer than a year, can build up when developers lack time or resources to address potentially dangerous flaws. Over time, these flaws accumulate, making organizations increasingly vulnerable to attackers.

Chris Eng, Chief Research Officer at Veracode, said, “The findings of this year’s EMEA SoSS report are a wake-up call for organizations in the region. Businesses should have a laser focus on remediating critical security debt first, given these flaws present the highest risk.”

Developers tasked with triaging and fixing flaws manually often fall short in tackling growing security debt, with slow remediation timelines and prioritization to blame. Analysis of remediation timelines in EMEA found it takes organizations using manual methods an average of 19 months to remediate flaws in third-party code, compared to nine months for first-party code. With such a vast number of flaws to address, organizations must prioritize which vulnerabilities to fix first, especially critical flaws.

When it comes to sources of security debt, the report found 84 percent of security debt overall comes from first-party code developed in-house. Meanwhile, 80 percent of critical security debt stems from third-party code, which often flies under the radar but can be just as dangerous for EMEA organizations. Crucially, the critical security debt statistic is considerably higher than the global rate of 65 percent.

Leveraging AI for Vulnerability Remediation

While AI code generators are increasingly used by developers to create software because of the speed and efficiency they bring, they don’t always produce secure code. Indeed, recent research found 36 percent of code generated by the AI-powered GitHub CoPilot tool contained security flaws.

AI can also be used to burn down security debt, supporting developers and security teams by dramatically reducing the time to fix vulnerabilities. Eng said, “AI-powered remediation tools can save teams a significant amount of time by automating fix recommendations and tackling flaws at scale. For example, our AI-powered remediation solution, Veracode Fix, has slashed fix times for common vulnerabilities from days to minutes, significantly enhancing developer productivity.”

Mitigating Security Debt in a Complex Environment

With three fifths (60 percent) of all flaws in EMEA organizations considered neither security debt nor critical severity, it becomes easier and more manageable for developers to focus on fixing the four percent that constitutes the highest risk. Once addressed, organizations can then go on to tackle non-critical security debt or more recent critical flaws, based on their risk tolerance and capabilities.

For those seeking prioritization guidance on security debt, Application Security Posture Management (ASPM) tools can continuously track risk through the collection, analysis and prioritization of security issues across the software development cycle.

ASPM tools have become more popular as they offer a comprehensive, unified view of risk across application stacks, and facilitate the remediation of issues. Longbow, powered by Veracode, delivers ASPM to get to the root cause of the issue through contextual analysis and suggests the best next actions to reduce the most risk with the least amount of effort.

Eng closed, “The prevalence of security debt among EMEA organizations highlights the need for immediate action to protect businesses against future breaches. Security leaders and developers should focus on patching the most critical flaws that introduce the most risk given their context. AI-powered security solutions that scale remediation efforts will enable teams to tackle their growing security debt more efficiently and reduce the amount of time vulnerabilities can be exploited.”