State of Pentesting Report 2022

Development Teams

Understand security

Detailed breakdowns of the most common flaws in 2021, with notes on how to fix and prevent them in future code.

Lacking manpower

The numbers behind feature launch delays, why code quality is at risk, and why devs are pushed to de-prioritize security.

Security Teams

Address vulnerabilities

Stats on the most prevalent vulnerabilities, how teams manage risk, and what gets fixed.

Focus on talent

The numbers on how talent shortages weaken security and how teams can respond.

Development Teams

Understand security

Detailed breakdowns of the most common flaws in 2021, with notes on how to fix and prevent them in future code.

Lacking manpower

The numbers behind feature launch delays, why code quality is at risk, and why devs are pushed to de-prioritize security.

Security Teams

Address vulnerabilities

Stats on the most prevalent vulnerabilities, how teams manage risk, and what gets fixed.

Focus on talent

The numbers on how talent shortages weaken security and how teams can respond.

1Cross-Site Scripting (XSS): Stored

This is a type of injection attack. Any feature that allows user input can be vulnerable because it gives attackers an opportunity to inject and store malicious scripts into web applications. The next time a user pulls up data that includes the attacker’s input, their browser attempts to run the malicious code.
2Broken Access Control: Insecure Direct Object References (IDOR)

IDOR can give access to resources via user-supplied input when attackers modify a value of a parameter that points directly to an object in your database. This flaw has the potential to give attackers access to personally identifiable information, which later enables identity theft, fraud, or blackmailing.
3Components with Known Vulnerabilities: Outdated Software Version

Using outdated software versions can leave you vulnerable to serious attacks, such as remote code execution with the recently discovered Log4j flaw. If you don’t have the latest version of Apache’s logging software, you have a vulnerability in your systems described as “a severe risk” by the Cybersecurity and Infrastructure Security Agency. And this is one of thousands of examples.
4Server Security Misconfiguration: Insecure SSL and TLS protocols

If teams use the SSL or TLS 1.1 protocols, their encryption is not secure. Attackers with a Man-in-the-Middle (MITM) position can break into older secure communication channels and attempt to decrypt the information. Some configurations also allow an attacker to downgrade communication from a stronger cipher suite to one that they can crack.
5Server Security Misconfiguration: Lack of Security Headers

Security headers can help mitigate different attacks, such as Clickjacking, XSS, and encryption-related downgrade attacks. They can also strengthen privacy by enabling users to use their browsers’ security features such as disabling access to their webcam or microphone. Missing these configurations puts your operations and customers at risk.

1Cross-Site Scripting (XSS): Stored

This is a type of injection attack. Any feature that allows user input can be vulnerable because it gives attackers an opportunity to inject and store malicious scripts into web applications. The next time a user pulls up data that includes the attacker’s input, their browser attempts to run the malicious code.

2Broken Access Control: Insecure Direct Object References (IDOR)

IDOR can give access to resources via user-supplied input when attackers modify a value of a parameter that points directly to an object in your database. This flaw has the potential to give attackers access to personally identifiable information, which later enables identity theft, fraud, or blackmailing.

3Components with Known Vulnerabilities: Outdated Software Version

Using outdated software versions can leave you vulnerable to serious attacks, such as remote code execution with the recently discovered Log4j flaw. If you don’t have the latest version of Apache’s logging software, you have a vulnerability in your systems described as “a severe risk” by the Cybersecurity and Infrastructure Security Agency. And this is one of thousands of examples.

4Server Security Misconfiguration: Insecure SSL and TLS protocols

If teams use the SSL or TLS 1.1 protocols, their encryption is not secure. Attackers with a Man-in-the-Middle (MITM) position can break into older secure communication channels and attempt to decrypt the information. Some configurations also allow an attacker to downgrade communication from a stronger cipher suite to one that they can crack.

5Server Security Misconfiguration: Lack of Security Headers

Security headers can help mitigate different attacks, such as Clickjacking, XSS, and encryption-related downgrade attacks. They can also strengthen privacy by enabling users to use their browsers’ security features such as disabling access to their webcam or microphone. Missing these configurations puts your operations and customers at risk.

Cobalt-State of Pentesting-Risk-Remediation-Informational

Risk Level: Informational

Notes vulnerabilities of minimal risk to your business.

Cobalt-State of Pentesting-Risk-Remediation-Low

Risk Level: Low

Specifies common vulnerabilities with minimal impact on their own, but dangerous if successfully chained.

Cobalt-State of Pentesting-Risk-Remediation-Medium

Risk Level: Medium

Vulnerabilities that are
“Medium risk <> Medium impact,” “Low risk <> High impact,” or “High risk <> Low impact.”

Cobalt-State of Pentesting-Risk-Remediation-High

Risk Level: High

Impacts the security of your application platform/hardware, including supporting systems. Includes high probability vulnerabilities with a high business impact.

Cobalt-State of Pentesting-Risk-Remediation-Critical

Risk Level: Critical

Includes vulnerabilities such as administrative access, remote code execution, financial theft, and more.

Cobalt-State of Pentesting-Risk-Remediation-Informational-Mobile