Living on a knife edge

It's a precarious world for many businesses today. Everyone is trying to ramp up their digital delivery speed whilst the cyber security threat escalates exponentially. More software vulnerabilities are being found than ever before (a 38% increase in 2024 vs 2023¹) and attackers are moving faster in making exploits available. Time to exploit for critical vulnerabilities dropped to 5 days in 2023, from 32 days in 2022⁶.

// EVERYONE IS A TARGETA low profile won't protect you

Probing and scanning by attackers is often automated and ubiquitous, looking for anyone with an internet presence and the trace of an exploitable vulnerability. Over 96% of organisations reported every one of their production applications being attack probed over 5,000 times per month in 2024, with 37% reporting 15,000 probes per month³.

"You don't escape because you're low key. You escape because there's nothing there to find."

// THE THREAT WINDOWFixes aren't keeping pace with exploits

Whilst organisations are also moving faster to fix vulnerabilities when they emerge, it's nothing like the same rate. On average, it took 45 days to remediate the highest severity vulnerabilities in 2024⁴, against less than 5 days for attackers to develop and start sharing exploits.

Despite this threat window widening all the time, organisations are still taking shortcuts in their security regimes, with 50% knowingly sacrificing security testing in the face of delivery pressures⁵. New vulnerabilities are a problem, but fixing known vulnerabilities that are already exploitable in the wild is equally problematic. 55% of the vulnerabilities with a CVSS (Common Vulnerability Scoring System) score above 7.0 discovered in software in 2024 were between 1 and 4 years old⁴.

// THE SUPPLY CHAINIt's not just the software you write

Most applications use high numbers of open source libraries and call third-party software at runtime, many of which present an easy access point for attackers. Auditing 1,000 applications in 2025, the OSSRA (Open Source Security and Risk Analysis) report found 86% of applications using vulnerable open source components, with 81% containing critical and high vulnerabilities⁷.

Despite this, 50% of organisations have either limited scanning or no scanning at all of their open source and third-party dependencies⁸. That is despite a 1,300% increase in malicious open source packages being discovered between 2020 and 2023⁹.

// THE RESPONSETrading off security for speed is the wrong model

It might achieve a short-term goal, but that's irrelevant if you invite a breach that puts your business at risk. The following aren't the domain of the 'leading edge' any more. They're the table stakes that keep you operating securely in a threat-rich world:

• Scanning your software and infrastructure statically and dynamically during build cycles.
• Securing pipelines and code repositories.
• Enforcing policies automatically.
• Scanning open source libraries, third-party software and runtime dependencies.

Building these checks into delivery is a core part of our engineering excellence work.