As security continues to shift left and DevSecOps efforts expand, software security best practices are rapidly evolving. The State of Software Security Report conducted by the application security company Veracode, showed that on average, organizations are running scans on their apps 20 times more than they were just 10 years ago. With this, the report also revealed that scan frequency has seen a dramatic increase, with developers now testing more than 17 new applications per quarter, more than triple what was reported for the same period a decade ago. 

“Part of this is due to the speed of innovation that has happened in the past few years. More and more software is being written and organizations are realizing that there’s a bit of exposure there. There’s more customer data being put into those things and the business is being driven by these applications so it’s important to make sure that they’re secure,” said Chris Eng, chief research officer at Veracode.

Additionally, there has been a 31% increase in the use of multiple security scan types between 2018 and 2021, with the majority of developers choosing to utilize a combination of static, dynamic, and SCA scans. The study found that organizations that used both dynamic and static scanning were able to remediate 50% of flaws 24 days faster on average. Add SCA scanning to that and it shaves off another 6 days. 

Veracode’s report also showed that organizations that invest in hands-on security training early on have a strong advantage over those that don’t. According to the study, companies with this kind of training in place fixed flaws 35% faster than those without. 

The report also showed that in 2018, about 20% of apps were operating using multiple languages, but this number dipped to just 5% in 2021. “The composition of applications has changed pretty significantly over the past few years, going from a lot more multi-language applications to that just kind of petering out a little bit, and it coincides with increasing developer interest in microservices so it was kind of cool to see that trend,” Eng said.

Another section of the report focused heavily on the use of open-source libraries and third-party code and the way they are being leveraged by different organizations. It revealed that most of the code in Java applications comes from third parties, and Java continues to push further in that direction. It was also reported that .NET experienced an unexpected upward shift in the percentage of third-party code in its applications; this happened around the release of .NET 5 and resulted in a sharp increase in use of third-part code. 

Additionally, the report reinforced the findings of previous studies that stated that developers tend to stick to the libraries they know and love rather than bouncing around and refactoring their code base in order to switch to the newest or “most popular” libraries.