App attacks surged to 83% as AI-assisted malware expands

At a glance

What this is: Arxan Technologies reports that app attacks rose to 83% in January 2025, driven by AI-assisted malware, higher attack profitability and broader attack democratization.

Why it matters: Security teams need to treat application risk as a continuous hardening problem across mobile, web and desktop estates, not a perimeter problem.

By the numbers:

• App attacks surged to 83% in January 2025.
• App attacks were up from 65% in 2024.

Context

Application attacks target the software layer itself, including mobile, web and desktop apps that sit outside traditional corporate perimeter controls. When attack methods become cheaper and more repeatable, defence has to move from boundary protection to code, runtime and release-stage hardening.

This report points to a governance gap that many security programmes still carry: tools are often tuned to internal assets while the attack surface keeps expanding into user-facing applications. The identity angle is indirect but real, because applications frequently mediate authentication, sessions, tokens and user entitlements that attackers can exploit once the app layer is weakened.

Key questions

Q: How should teams harden applications that sit outside the perimeter?

A: Start with the apps that are internet-facing, customer-facing or updated most often, then validate authentication, session handling, input controls and runtime monitoring together. Perimeter tools alone do not govern application logic, so the control objective is continuous application hardening tied to exposure and business impact.

Q: Why do AI-assisted attacks increase application risk so quickly?

A: AI-assisted tooling reduces the effort required to find exposed endpoints, vary payloads, and test credentials at scale. That means the same weakness can be exploited faster and more repeatedly, even if the underlying vulnerability is familiar. Teams should assume that attack volume and speed will rise before their detection and response processes are fully adapted.

Q: Where does application security fail when teams rely on infrastructure-centric controls?

A: It fails when attackers stay inside business logic, APIs, and pipeline trust paths that host and network tools cannot see well. Infrastructure controls can confirm that something reached a workload, but they do not reliably show how an application flow was abused. That leaves logic abuse, dependency poisoning, and service-to-service misuse under-governed.

Q: Should organisations prioritise perimeter hardening or mobile controls first?

A: Do both, but prioritise whichever path currently exposes the most privileged access. If external gateways and SSO appliances are internet-facing, hardening them first reduces immediate blast radius. If BYOD is a major access channel, mobile application control and posture enforcement become equally urgent because they protect the credentials users bring into the environment.

Technical breakdown

Why application attack growth outpaces perimeter controls

Application attacks succeed when defenders assume the network boundary still meaningfully separates trusted from untrusted traffic. Mobile, web and desktop applications are exposed to users, devices and API traffic that bypass classic perimeter logic, so attackers can probe inputs, sessions and client-side behaviour directly. As software delivery accelerates, the attack surface grows through faster releases, more dependencies and more exposed functionality. The practical issue is not just more vulnerabilities, but more opportunities to reach the application logic that perimeter tools were never designed to govern.

Practical implication: Shift security investment toward application-layer hardening, validation and runtime monitoring rather than relying on network segmentation alone.

How AI-assisted malware changes the economics of app attacks

AI-assisted malware lowers the skill and time needed to build, adapt and distribute malicious tooling. That changes the attacker cost curve: more actors can automate reconnaissance, vary payloads and scale attempts across many targets. In application security terms, defenders face faster mutation of attack patterns and a higher volume of commodity abuse aimed at exposed apps. The report's point is not that AI creates a new class of exploit, but that it makes existing application abuse easier to industrialise.

Practical implication: Increase detection and response coverage for rapidly changing application attack patterns, not just known signatures or static abuse cases.

Why democratized attack methods widen exposure across app estates

When attack techniques become more accessible, the threat is no longer limited to highly skilled operators. Lower barriers encourage broader targeting of web, mobile and desktop software because attackers can reuse techniques across many applications. That matters for governance because exposure is often uneven across app portfolios, with different owners, release cadences and hardening maturity. The result is a governance problem as much as a technical one: the weakest app path becomes the easiest route for repeatable compromise.

Practical implication: Classify applications by exposure and business criticality so the highest-risk app paths get the strongest testing and monitoring first.

NHI Mgmt Group analysis

Application attack inflation is now a governance problem, not just a malware problem. When attack frequency rises from 65% to 83%, the issue is no longer isolated exploitation but a broader failure to keep pace with exposed software estates. That means app security ownership has to align with release velocity, runtime exposure and business criticality. Practitioners should treat application hardening as an operational control, not a periodic hygiene task.

AI-assisted malware changes the attacker advantage more than it changes the control objective. The security goal remains the same, reduce exploitable surface and detect abuse early, but the pace of variation increases. That pushes teams toward continuous verification of application behaviour, not one-time testing at release. The practical conclusion is that static control assumptions age faster when adversaries can iterate automatically.

Application hardening gap: the report exposes a common assumption that protecting internal assets is enough when applications sit outside the firewall. That assumption fails because the app layer is often the real boundary of trust, where sessions, tokens and user actions are mediated. Teams that do not govern the application layer as a distinct risk domain will keep inheriting attacks that perimeter tools never see.

Identity controls become more important once attackers move inside the application boundary. Even though this is not an IAM-first article, application compromise often becomes an identity compromise because apps broker authentication and authorisation decisions. That means session control, token handling and entitlement checks are part of app defence, not downstream concerns. Security programmes should align application testing with identity control validation wherever apps issue or consume credentials.

The market signal is clear: application security is converging with continuous exposure management. Attack volume, AI assistance and attack democratization all point in the same direction, toward faster identification of externally reachable app weaknesses. The relevant control question is no longer whether an app was once tested, but whether it remains hardened as the codebase and threat landscape change. Practitioners should expect more pressure to tie app security to lifecycle and runtime governance.

What this signals

Application security is becoming a continuous exposure problem. The practical shift is away from periodic testing toward ongoing governance of the app layer as code, dependencies and runtime conditions change. That has direct consequences for release pipelines, runtime monitoring and ownership models, especially where applications mediate access to data or authenticated sessions.

Identity controls sit inside the application risk boundary. When applications are the main target, authentication, sessions and entitlements cannot be treated as separate IAM concerns that begin after the app layer. Practitioners should expect more pressure to verify identity-handling paths as part of application assurance, especially where customer access or privileged workflows are involved.

For practitioners

• Harden externally exposed applications first Prioritise mobile, web and desktop applications that are reachable outside the corporate perimeter, then map which of them handle authentication, sessions, tokens or customer data.
• Treat application hardening as continuous Move from periodic testing to ongoing validation of code, configuration and runtime behaviour so newly introduced exposure does not remain open until the next release cycle.
• Rank applications by attackability and business impact Build a portfolio view that separates internet-facing, high-change and customer-impacting applications from lower-risk internal software, then assign testing depth accordingly.
• Review identity controls inside the app boundary Check whether application-layer authentication, session handling and entitlement checks are being verified with the same discipline as the app itself.

Key takeaways

• Application attacks are rising fast, and the report ties that increase to AI-assisted malware, higher attacker profitability and easier reuse of attack methods.
• The security gap is not just more malware, but a mismatch between perimeter-centric tools and applications that remain exposed across web, mobile and desktop environments.
• Practitioners should move to continuous application hardening and link it to identity handling, runtime visibility and exposure-based prioritisation.

Key terms

• Application Hardening: The process of reducing an application’s attack surface by tightening configuration, authentication, dependencies, runtime behaviour, and monitoring. In mature programmes, hardening is continuous and linked to identity and secrets governance, not a one-time release activity.
• AI-Assisted Malware Rewriting: The process of using generative AI to refactor malicious code into a different language, structure, or style. Attackers use it to bypass signatures, frustrate endpoint detection, and make familiar tooling look new. The security impact is not novelty, but faster evasion and easier operational iteration.
• Attack Surface Management: Attack surface management is the practice of finding and evaluating assets that could be exposed to misuse or compromise. CAASM focuses on internal visibility across the environment, while EASM focuses on externally reachable assets. It is a discovery discipline, not a complete identity control model.
• Application Exposure Drift: The gap that opens when a mobile app’s approved state no longer matches its real-world exposure. SDK updates, API changes, distribution changes, and delayed user upgrades can all alter risk without a formal revalidation event.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps practitioners connect identity controls to the wider security programme that protects applications and services.