Study found less than 25 percent of developers test components for vulnerabilities at every release

BURLINGTON, Mass. – April 10, 2018 – / — CA Veracode, part of CA Technologies (NASDAQ:CA) industry-leading security portfolio, today released new data that shines a light on the discrepancy between component security and hygiene. According to the research conducted with Vanson Bourne, only 52 percent of developers using commercial or open source components in their applications update those components when a new security vulnerability is announced.  This highlights organizations’ lack of security awareness and puts organizations at risk of a breach.

Software development processes like DevSecOps have helped improve the security of the code developers write. However, these same development processes value speed and efficiency to keep up with the demands of the application economy.  As a result, developers rely on components that borrow features and functionality from existing projects and libraries. The research shows that 83 percent of respondents use either or both commercial and open source components, with an average of 73 components being used per application.

While components boost developers’ efficiency, and their use is considered a best practice, these components come with inherent security risks. Despite finding an average of 71 vulnerabilities per application introduced through the use of third-party components, only 23 percent of respondents reported testing for vulnerabilities in components at every release. This may be a result of only 71 percent of organizations reporting to having a formal application security (AppSec) program in place.

What’s more, only 53 percent of organizations keep an inventory of all components in their applications. According to The State of Software Security Report 2017(SOSS), fewer than 28 percent of companies conduct regular composition analysis to understand which components are built into their applications.

“We know that developers care about creating great code, and that means creating secure code,” said Pete Chestna, director of developer engagement, CA Veracode. “In order to be successful, developers need to have clarity on the security policy and the tools to measure against it. When the goal is clear and we give developers access to those tools, they are able to integrate scanning earlier into the SDLC and make informed decisions that take security into consideration. Through this, we see a marked improvement in secure software development and the resulting outcomes.”

This report shows that development (44 percent) or security (31 percent) teams are most likely to be responsible for the maintenance of third-party commercial and open source components, which suggests a move towards responsibility for the development team. As awareness around open source risk continues to grow, providing developers with the solutions, education and visibility to mitigate risk becomes a critical component to the Modern Software Factory approach to development that helps to build better, more secure, apps faster.

To read the full research report conducted in conjunction with Vanson Bourne, click here –

To learn more about CA Veracode’s Software Composition Analysis solution, click here –

CA Veracode commissioned Vanson Bourne to survey 400 application developers from the U.S. (200 respondents), UK (100 respondents), and Germany (100 respondents) to understand the maturity of organizations’ component security. Polling was conducted online in February of 2018.

About CA Veracode
Veracode, CA Technologies application security business, is a leader in helping organizations secure the software that powers their world. Veracode’s SaaS platform and integrated solutions help security teams and software developers find and fix security-related defects at all points in the software development lifecycle, before they can be exploited by hackers. Our complete set of offerings help customers reduce the risk of data breaches, increase the speed of secure software delivery, meet compliance requirements, and cost effectively secure their software assets- whether that’s software they make, buy or sell.

Veracode serves over a thousand customers across a wide range of industries, including nearly one-third of the Fortune 100, three of the top four U.S. commercial banks and more than 20 of Forbes’ 100 Most Valuable Brands. Learn more at, on the Veracode blog, on Twitter and in the CA Veracode Community.

Follow CA Technologies

  • Twitter
  • Social Media Page
  • Press Releases
  • Blogs

Press Contacts
Laura Paine
Phone: (339) 674-1535

Megan Grasty
Highwire for Veracode (U.S.)
Phone: (415) 963-4174, x26

Kate Baldwin
Hotwire for Veracode (UK & EMEA)
Phone: +44 (0) 207 608 4677

Source: CA Technologies



General Tags: online backup, software as a service, online backup companies, online backup services, top rated online backups, backing up online, data security, CEO interviews, online file storage, online backup reviews, data storage, online backup providers directory, online file backup, cloud computing, online data backup, online backup news, SaaS, compare online backups

Like us on Facebook

Do you like this post? Subscribe to our RSS feed ===========================


Related posts:

  1. Kaspersky Research Finds Employees ‘Confidently’ Make 90% of All Security Awareness Mistakes
  2. Dell Data Security Survey Finds that a Lack of Security Knowledge Limits Business Initiatives
  3. Global Survey Finds 85% of Mobile Apps Fail to Provide Basic Privacy Information
  4. Research Finds Android Handsets Suffer from Region-specific Security Issues
  5. Three’s A Crowd: Businesses Working With Too Many Cloud Providers, Telstra Research Finds
  6. EMC Creates Open Source Project, Offers Free Downloads of Software-Defined Storage Product
  7. Carbonite Research Reveals Businesses Fail to Protect Their Corporate Data
  8. AURO Cloud Announces Partnership With Bitnami to Bring Easy, Open-Source One-Click Applications to Canadian Cloud Computing Customers
  9. Open Source Storage Announces Latest Version of OSS Cloud
  10. Popular Open Source File Sharing Project Creates Commercial Entity and Taps Former SUSE Exec as CEO and CTO

Tags: ,