Research on web application vulnerabilities, attack vectors, and defensive strategies. Drawn from OWASP, security research institutions, and vulnerability disclosure programmes.
We've pulled data from multiple authoritative sources:
This research focuses on common web application frameworks (PHP, JavaScript, Python). Compliance data primarily covers UK and EU regulations. Note that vulnerability statistics may underrepresent unreported zero-days.
Verified statistics from vulnerability databases, security assessments, and compliance audits
Analysis of web application vulnerabilities found in production systems during security assessments and penetration testing.
Survey of security professionals and analysis of vulnerability databases. Sample includes enterprise applications, SME websites, and SaaS platforms.
Cross-Site Scripting (XSS) remains one of the most common vulnerability classes in modern web applications.
Analysis of vulnerability disclosure reports and CVE database entries for web applications over 24-month period.
Proportion of web applications with authentication or session management vulnerabilities discovered during security testing.
Penetration testing results from 500+ web applications across various industries and technology stacks.
UK businesses struggling to maintain full GDPR compliance in web applications handling personal data.
Survey of 1,200 UK businesses and compliance audits of their web applications. Focus on data handling, consent, and breach notification.
Average time from vulnerability disclosure to patch deployment in production web applications.
Analysis of CVE remediation timelines across 2,000+ web applications. Metrics include discovery, patch availability, testing, and deployment.
Annual cost for small-to-medium e-commerce businesses to achieve and maintain PCI-DSS compliance including assessments, remediation, and ongoing monitoring.
Survey of 300 UK e-commerce businesses handling card payments. Costs include QSA fees, infrastructure changes, and quarterly scanning.
Analysis of web application vulnerabilities found in production systems during security assessments and penetration testing.
Survey of security professionals and analysis of vulnerability databases. Sample includes enterprise applications, SME websites, and SaaS platforms.
Cross-Site Scripting (XSS) remains one of the most common vulnerability classes in modern web applications.
Analysis of vulnerability disclosure reports and CVE database entries for web applications over 24-month period.
Proportion of web applications with authentication or session management vulnerabilities discovered during security testing.
Penetration testing results from 500+ web applications across various industries and technology stacks.
UK businesses struggling to maintain full GDPR compliance in web applications handling personal data.
Survey of 1,200 UK businesses and compliance audits of their web applications. Focus on data handling, consent, and breach notification.
Average time from vulnerability disclosure to patch deployment in production web applications.
Analysis of CVE remediation timelines across 2,000+ web applications. Metrics include discovery, patch availability, testing, and deployment.
Annual cost for small-to-medium e-commerce businesses to achieve and maintain PCI-DSS compliance including assessments, remediation, and ongoing monitoring.
Survey of 300 UK e-commerce businesses handling card payments. Costs include QSA fees, infrastructure changes, and quarterly scanning.
The OWASP Top 10 lists the most critical security risks to web applications. Updated every 3-4 years based on industry data.
Injection attacks remain prevalent despite widespread awareness. SQL injection still plagues legacy applications. Broken access control is the most common finding in penetration tests. Security misconfiguration affects cloud-native and containerised applications particularly badly.
Authentication and session management are critical security boundaries in web applications. Get these wrong and nothing else matters.
Weak Password Policies
Session Management Flaws
Multi-Factor Authentication (MFA) Gaps
Web applications handling sensitive data face multiple regulatory frameworks. Here's what you need to know.
Data Protection Principles
Breach Notification
Requirements for E-Commerce
SAQ (Self-Assessment Questionnaire)
Apply this research to your projects with our security expertise
Transform unmaintainable legacy code into a clean, modern codebase that your team can confidently build upon.