ContrastSecurity Software Under Siege 2025

Keypoints

• Annual cybersecurity reports like this typically begin with an executive summary that states the most important trends, risk levels, and takeaways for readers who need a fast overview.
• They then describe the threat landscape, often breaking down the most common attack types, how often attacks occur, and which targets are most exposed.
• A dedicated attack analysis section usually explains attack categories, techniques, and notable patterns observed in telemetry or incident data.
• Vulnerability sections generally quantify findings by severity, affected technologies, and prevalence, showing where exposure is increasing or remaining persistent.
• Reports also include defender-focused analysis, comparing attacker speed with detection, containment, and patching timelines to show operational gaps.
• Many conclude with strategic guidance or recommendations, outlining how organizations can change their security posture based on the report’s findings.
• A major finding in this report is that application-layer attacks are now a primary battleground, with the average application facing 81 confirmed viable attacks per month and more than 10,000 probes and unsuccessful attempts.
• The report says applications are targeted more than 14,000 times per month on average, or roughly once every 3 minutes, reinforcing that these attacks are continuous rather than occasional.
• Web application attacks were among the top 3 incident types in the Verizon DBIR 2025, underscoring the mainstream nature of application compromise.
• IDC data cited in the report shows application-related catalysts triggered 35% of ransomware incidents, with an average cost of $4.91 million per incident.
• Mandiant M-Trends 2025 found that 33% of breaches began with a vulnerability exploit, highlighting how frequently initial access still comes through software flaws.
• More than half of intrusions, 57%, are discovered through external sources rather than internal detection, showing that SOC visibility remains weak.
• The average application has close to 30 serious, exploitable vulnerabilities, while new vulnerabilities arrive at a rate of about 17 per month per application.
• This creates a widening backlog because development and AppSec teams can remediate only about six vulnerabilities per application per month on average.
• The report emphasizes that AI-generated code and third-party dependencies are accelerating the growth of software exposure.
• Attackers are exploiting new vulnerabilities in just 5 days on average after disclosure, creating an extremely short response window for defenders.
• By contrast, defenders need an average of 194 days to identify a breach and another 64 days to contain it, revealing a severe asymmetry in speed.
• Even critical vulnerabilities take about 84 days to remediate on average, far beyond the typical attacker time-to-exploit.
• The report highlights recurring techniques such as method tampering and untrusted deserialization, showing that attackers continue to favor application logic and library weaknesses.
• The overall message is that traditional perimeter and endpoint defenses are insufficient for application-layer threats, and organizations need proactive, runtime-based application detection and response.