74 percent of cloud and web applications with PII are vulnerable to exploits

New research reveals a high proportion of vulnerable public cloud, mobile and web applications exposing sensitive data, including unsecured APIs and personal identifiable information (PII).

The study from CyCognito, based on analysis of 3.5 million assets across its enterprise customer base, finds 74 percent of assets with PII are vulnerable to at least one known major exploit, and one in 10 have at least one easily exploitable issue.

"The latest MOVEit exploit is a cautionary tale for all CISOs that attackers remain many steps ahead of web application and cloud security," says Rob Gurzeev, CEO and co-founder, CyCognito. "The volume of exposed PII stemming from this disastrous breach supports our findings and underscores the critical need for full-scope visibility of all assets across an organization's attack surface. Businesses can no longer afford to neglect their digital shadow and the many unknown and unmanaged risks within their systems."

See also:

• Sensitive data is exposed in over 30 percent of cloud assets
• Over half of Azure and Google Cloud deployments fail CIS benchmarks
• Enterprises struggle with basic security hygiene

In addition 70 percent of web applications have severe security gaps, like lacking WAF protection or an encrypted connection like HTTPS, while 25 percent of all web applications (web apps) lacked both. This is concerning since a typical global enterprise has over 12 thousand web apps, which can include APIs, SaaS applications, servers, and databases, among others.

The report also shows that 98 percent of web apps are potentially not GDPR compliant due to the lack of an option for users to opt out of cookies.

Gurzeev adds, "The size of a company's attack surface fluctuates up and down by as much as 10 percent a month, making it a moving target rife with security gaps ready to be exploited. Our latest research is not only a wake-up call that no business is immune to risk; it's also clear proof that unknown and undiscovered assets present a major threat to an organization."

You can get the full report from the CyCognito site.

Image credit: kenary820 / Shutterstock