Notifications
Clear all
Topic starter
01/08/2026 8:55 pm
TL;DR: Enterprise application attack rates rose from 55% in 2022 to 87% in 2026, while first hostile contact now occurs just 1 hour and 56 minutes after app store publication, according to Arxan Technologies. AI has compressed reverse-engineering and attack preparation enough that defenders must treat application exposure as an immediate runtime governance problem, not a post-release concern.
NHIMG editorial — based on content published by Arxan Technologies: 2026 Application Security Threat Report
By the numbers:
- Since 2022, the attack rate on enterprise applications has risen from 55% to 87%.
- Connected-vehicle apps are now attacked at the same rate as banking apps, at 91% each.
Questions worth separating out
Q: How should security teams reduce the risk from public-facing application attacks?
A: Treat publication as the start of active defence, not the end of testing.
Q: Why do application secrets create identity risk as well as appsec risk?
A: Because secrets are machine credentials.
Q: What breaks when secrets are left in deployed applications?
A: Standing credentials turn a code issue into a trust issue.
Practitioner guidance
- Shorten the release-to-monitoring gap Start runtime monitoring before public release, with alerting on first hostile contact, anomalous API calls, and secret extraction attempts in the first hours after publication.
- Bind application trust to workload identity Replace embedded secrets and long-lived tokens with workload identity and short-lived credentials wherever the application calls downstream services.
- Inventory exposed trust material across mobile and API surfaces Map tokens, certificates, keys, and third-party API credentials by application, then revoke or rotate anything that can survive outside its intended runtime.
What's in the full report
Arxan Technologies' full whitepaper covers the operational detail this post intentionally leaves for the source:
- Telemetry methodology behind the billion-instance application dataset and how hostile contact timing was measured
- Vertical-by-vertical attack-rate breakdowns for banking, connected vehicles, medical devices, and mobile apps
- The report's publication-era threat patterns, including why AI has lowered the cost of reverse-engineering apps
- Operational context for teams deciding which application hardening controls to prioritise first
👉 Read Arxan Technologies' 2026 Application Security Threat Report →
App attack rates hit 87%: what appsec teams need to change?
Explore further
01/08/2026 9:03 pm
AI has collapsed the attacker time-to-insight for exposed applications. The report's numbers point to a new baseline where publication and analysis are effectively simultaneous. That matters because traditional appsec models still assume a slower discovery cycle, leaving too much time for secrets, endpoints, and APIs to be probed before controls adapt. Practitioners should treat release-day hardening as a core operational requirement, not a post-release task.
A question worth separating out:
Q: How do security teams know if application hardening is keeping pace with attackers?
A: Measure the time from publication to hostile contact, the percentage of apps with embedded secrets, and the speed of revocation after exposure. If any of those metrics drift upward, attackers are gaining operational advantage faster than defenders are closing it.
👉 Read our full editorial: Application attack rates surged to 87% as AI compresses attacker costs
